CIPT Certified Information Privacy Technologist: Data Privacy Frameworks and Models 5 — Questions and Answers
Question 1: Which privacy model treats privacy as a resource that individuals can selectively grant or withdraw, analogous to property rights?
- Privacy as control (property-rights model) (Correct answer)
- Privacy as contextual integrity
- Privacy as a public good
- Privacy as confidentiality
Correct answer: Privacy as control (property-rights model)
The privacy-as-control or property-rights model views personal data as belonging to individuals who may grant licenses for its use.
Question 2: In the CIPT body of knowledge, which privacy-enhancing technology (PET) allows a verifier to confirm a fact about a user without learning the underlying data?
- Symmetric encryption
- Zero-knowledge proof (Correct answer)
- Transport Layer Security
- Role-based access control
Correct answer: Zero-knowledge proof
A zero-knowledge proof enables one party to prove knowledge of a value to another party without conveying any information beyond the validity of the statement.
Question 3: An organization's privacy notice discloses that it shares data with 'partners for marketing purposes.' Under GDPR transparency requirements, what is missing?
- The name of the data protection officer
- The specific identities or categories of third-party recipients (Correct answer)
- The organization's revenue figures
- The data retention schedule for audit logs
Correct answer: The specific identities or categories of third-party recipients
GDPR Article 13/14 requires disclosing the recipients or categories of recipients of personal data, not just a vague description like 'partners.'
Question 4: The concept of 'privacy by default' in GDPR Article 25 primarily requires that:
- All system features be disabled until the user enables them
- The most privacy-protective settings are active without user action (Correct answer)
- Users must opt-in before any data processing begins
- Data is anonymized by default before any transfer
Correct answer: The most privacy-protective settings are active without user action
Privacy by default means that, by default, only personal data necessary for each specific purpose is processed, without requiring action from the data subject.
Question 5: Which international standard provides guidance on privacy information management systems (PIMS) and is complementary to ISO/IEC 27001?
- ISO/IEC 29134
- ISO/IEC 27701 (Correct answer)
- ISO/IEC 29100
- ISO/IEC 27018
Correct answer: ISO/IEC 27701
ISO/IEC 27701 extends ISO 27001 by specifying requirements and guidance for establishing and continually improving a Privacy Information Management System (PIMS).
Question 6: A data controller conducts profiling that produces legal or similarly significant effects on individuals. Under GDPR, what right do individuals have in this scenario?
- The right to data portability for all profiled data
- The right not to be subject to solely automated decision-making (Correct answer)
- The right to erasure of all profile data within 24 hours
- The right to access the source code of the profiling algorithm
Correct answer: The right not to be subject to solely automated decision-making
GDPR Article 22 gives individuals the right not to be subject to decisions based solely on automated processing, including profiling, that produce significant effects.
Question 7: In privacy risk analysis, 'likelihood' refers to the probability that a threat will exploit a vulnerability, while 'impact' refers to what?
- The cost of implementing a privacy control
- The harm to individuals if the privacy event occurs (Correct answer)
- The number of records involved in a breach
- The time required to detect the privacy incident
Correct answer: The harm to individuals if the privacy event occurs
Impact in privacy risk analysis measures the degree of harm — such as financial loss, reputational damage, or discrimination — that individuals would experience if the risk materializes.
CIPT Certified Information Privacy Technologist: Data Privacy Frameworks and Models 5
Which privacy model treats privacy as a resource that individuals can selectively grant or withdraw, analogous to property rights?