CIPT Certified Information Privacy Technologist: Privacy Regulations and Compliance Practice 4

Question 1

Under GDPR, processing personal data based on legitimate interests requires a balancing test. Which factor weighs AGAINST legitimate interests?

Accepted Answer

The processing involves sensitive categories of personal data

Answer

Processing sensitive categories of personal data weighs heavily against relying on legitimate interests as a legal basis, as such data carries heightened privacy risks requiring stronger justification.

Question 2

Which U.S. law requires federal agencies to publish notices in the Federal Register describing their systems of records?

Accepted Answer

Privacy Act of 1974

Answer

The Privacy Act of 1974 requires federal agencies to publish System of Records Notices (SORNs) in the Federal Register describing collections of personal information maintained in systems of records.

Question 3

A company collects biometric data in Illinois. Under the Illinois Biometric Information Privacy Act (BIPA), what must the company do BEFORE collection?

Accepted Answer

Obtain written release from the subject and publish a retention schedule

Answer

BIPA requires companies to inform subjects in writing about the collection, its purpose, and duration; and obtain a written release before collecting biometric identifiers or information.

Question 4

Under the Texas Data Privacy and Security Act (TDPSA), which entity is exempt from the law's requirements?

Accepted Answer

Financial institutions subject to GLBA

Answer

TDPSA exempts financial institutions and data subject to the GLBA, as well as covered entities and business associates subject to HIPAA, from its requirements.

Question 5

A multinational company implements binding corporate rules (BCRs) to enable intra-group data transfers. Who must approve BCRs before they can be relied upon?

Accepted Answer

A competent supervisory authority

Answer

BCRs must be approved by a competent supervisory authority (the lead Data Protection Authority for the group) following the cooperation procedure, before they can be used as a transfer mechanism.

CIPT - Certified Information Privacy Technologist Practice Test

CIPT - Certified Information Privacy Technologist Practice Test

CIPT Certified Information Privacy Technologist: Privacy Regulations and Compliance Practice 4