CIPT Certified Information Privacy Technologist: Privacy Regulations and Compliance Practice 5

Question 1

An e-commerce company based in the U.S. sells goods to EU residents without any EU establishment. Does GDPR apply to this company?

Accepted Answer

Yes, because it offers goods to EU data subjects

Answer

GDPR Article 3(2) extends the regulation's territorial scope to controllers outside the EU that offer goods or services to data subjects in the EU, regardless of whether payment is required.

Question 2

Under HIPAA's Minimum Necessary standard, when does it NOT apply to a use or disclosure of PHI?

Accepted Answer

Disclosures to the individual who is the subject of the PHI

Answer

The Minimum Necessary standard does not apply to disclosures made to or requested by the individual who is the subject of the information, as they have an inherent right to their own PHI.

Question 3

A privacy engineer applies 'privacy by design' during system development. Which of the following best describes the 'proactive not reactive' principle of Privacy by Design?

Accepted Answer

Anticipate and prevent privacy risks before they occur rather than remediate after

Answer

Privacy by Design's first foundational principle, 'Proactive not Reactive; Preventative not Remedial,' means anticipating and preventing privacy risks before they materialize rather than responding after.

Question 4

Under the Connecticut Data Privacy Act (CTDPA), what is the cure period provided to controllers before the Attorney General may initiate enforcement?

Accepted Answer

60 days

Answer

The CTDPA provides a 60-day cure period through the end of 2024, after which cure opportunities become discretionary for the Attorney General.

Question 5

A company uses automated profiling to make credit decisions with significant effects on individuals. Under GDPR Article 22, what right do affected individuals have?

Accepted Answer

The right to obtain human review and contest the decision

Answer

GDPR Article 22 gives individuals the right not to be subject to solely automated decisions with significant effects, and the right to obtain human intervention, express their point of view, and contest the decision.

CIPT - Certified Information Privacy Technologist Practice Test

CIPT - Certified Information Privacy Technologist Practice Test

CIPT Certified Information Privacy Technologist: Privacy Regulations and Compliance Practice 5