Privacy Law Certification (PLC) — Questions and Answers

Question 1: What consequence can result from failing to maintain proper legal research & case analysis standards in Privacy Law?

Increased customer satisfaction
Lower training requirements
Loss of certification, legal penalties, and reputational damage (Correct answer)
Reduced workload for staff

Correct answer: Loss of certification, legal penalties, and reputational damage

Non-compliance can result in serious consequences including certification revocation, legal penalties, fines, and significant reputational damage.

Question 2: Under the Americans with Disabilities Act (ADA), medical examinations of job applicants are permitted only:

At any time with two weeks' written notice
At the employer's sole discretion for safety-sensitive roles
After a conditional job offer has been extended (Correct answer)
Before any interview is conducted

Correct answer: After a conditional job offer has been extended

The ADA permits medical examinations only after a conditional job offer has been made, and pre-offer inquiries about disabilities are prohibited.

Question 3: When learning new courtroom procedures & protocols in Privacy Law, which approach is MOST effective?

Learning theory only without hands-on practice
Observing others without ever performing the techniques
Combining theoretical study with supervised practical application (Correct answer)
Practicing without understanding underlying principles

Correct answer: Combining theoretical study with supervised practical application

The combination of theoretical knowledge and supervised practical application provides the deepest understanding and develops competent practitioners.

Question 4: What is the purpose of a 'post-mortem' or 'lessons learned' meeting after a data breach incident?

To identify what worked, what failed, and how to improve future response (Correct answer)
To draft the customer notification letter
To assign legal blame to responsible employees
To calculate financial losses for insurance claims

Correct answer: To identify what worked, what failed, and how to improve future response

Post-incident reviews identify gaps in preparation, response, and recovery to strengthen the organization's future incident handling capabilities.

Question 5: Which of the following is NOT typically required in a state breach notification letter to affected individuals?

Description of what happened
The name of the employee responsible for the breach (Correct answer)
Contact information for further inquiries
Types of information involved

Correct answer: The name of the employee responsible for the breach

State breach notification laws do not require naming the responsible employee; they require a description of the incident, data types involved, and remediation steps.

Question 6: Under HIPAA, when a breach affects 500 or more individuals in a single state or jurisdiction, covered entities must also notify:

The FBI Cyber Division within 30 days
The HHS Office for Civil Rights within 60 days and prominent local media outlets (Correct answer)
The FTC and HHS simultaneously within 72 hours
Only the affected individuals — no media or HHS notification required

Correct answer: The HHS Office for Civil Rights within 60 days and prominent local media outlets

HIPAA requires that breaches affecting 500+ individuals in a jurisdiction be reported to HHS-OCR within 60 days and to prominent media outlets in that jurisdiction.

Question 7: A company discovers that an employee accidentally emailed a spreadsheet containing 500 customers' Social Security numbers to the wrong recipient. What is the FIRST step in proper incident response?

Immediately notify all 500 affected customers
Contain the incident and assess its scope (Correct answer)
File a police report
Notify the FTC within 24 hours

Correct answer: Contain the incident and assess its scope

Incident response best practice dictates that containment and assessment of scope must occur first before notifications or external reporting.

Question 8: What did the Schrems II ruling invalidate?

Standard Contractual Clauses
Safe Harbor Agreement
GDPR
Privacy Shield (Correct answer)

Correct answer: Privacy Shield

The Schrems II ruling by the Court of Justice of the European Union (CJEU) invalidated the EU-U.S. Privacy Shield framework. The court found that the protections offered by the Privacy Shield for EU data subjects' data transferred to the U.S. were insufficient, particularly concerning U.S. government surveillance programs. This decision significantly impacted transatlantic data transfers and emphasized the need for robust safeguards.

Question 9: A breach notification to a state Attorney General is typically triggered when the number of affected state residents exceeds what threshold under most state laws?

100 residents
1,000 residents
Threshold varies; some states require notification regardless of number (Correct answer)
500 residents

Correct answer: Threshold varies; some states require notification regardless of number

Most state breach notification laws require AG notification when the breach exceeds 500 or 1,000 residents, but thresholds vary widely by state and some states have no minimum.

Question 10: When facing an unfamiliar challenge in dispute resolution & mediation within Privacy Law, what is the BEST approach?

Attempt to resolve it independently without consultation
Research established best practices, consult colleagues, and document the approach (Correct answer)
Apply the most familiar technique regardless of suitability
Avoid the challenge if possible

Correct answer: Research established best practices, consult colleagues, and document the approach

Researching best practices and consulting colleagues combines established knowledge with practical experience, while documentation supports future reference.

Question 11: What is a risk of non-compliance in cross-border data transfers?

Fines and legal actions (Correct answer)
Verbal warning
No business impact
License revocation only

Correct answer: Fines and legal actions

Non-compliance with cross-border data transfer regulations, such as those under GDPR, carries significant risks for organizations. These risks include substantial administrative fines, which can be millions of euros or a percentage of global annual turnover, as well as legal actions from supervisory authorities or data subjects. Additionally, non-compliance can lead to reputational damage and a loss of customer trust.

Question 12: Which is a lawful basis for data transfer under GDPR when no adequacy decision exists?

Global Certification
Binding Corporate Rules (Correct answer)
Privacy Consent Shield
Safe Harbor

Correct answer: Binding Corporate Rules

Binding Corporate Rules (BCRs) are internal codes of conduct approved by data protection authorities that allow multinational companies to transfer personal data internationally within their corporate group. They provide a robust legal framework for data transfers to countries without an adequacy decision, ensuring all entities within the group adhere to the same high standards of data protection. BCRs are a complex but effective mechanism for intra-group transfers.

Question 13: Which technique involves replacing direct identifiers (like names or SSNs) with artificial identifiers while retaining the ability to re-identify the data?

Tokenization for payment data
Anonymization
Pseudonymization (Correct answer)
Data masking for display purposes

Correct answer: Pseudonymization

Pseudonymization replaces identifying fields with artificial identifiers while keeping a separate key that enables re-identification, unlike full anonymization which is irreversible.

Question 14: Under the GDPR, what is the maximum administrative fine for severe violations?

€10 million or 2% of annual global turnover
€15 million or 3% of annual global turnover
€25 million or 5% of annual global turnover
€20 million or 4% of annual global turnover (Correct answer)

Correct answer: €20 million or 4% of annual global turnover

The GDPR imposes a two-tiered system for administrative fines. For the most severe violations, such as infringements of data subjects' rights or principles for processing, the maximum fine can be up to €20 million or 4% of the company's total worldwide annual turnover from the preceding financial year, whichever is higher. This significant penalty underscores the importance of strict adherence to GDPR requirements.

Question 15: In Privacy Law, how does document preparation & filing contribute to professional credibility?

By using impressive terminology
By demonstrating competence, maintaining standards, and delivering consistent results (Correct answer)
By avoiding challenging situations
Through the number of years in practice alone

Correct answer: By demonstrating competence, maintaining standards, and delivering consistent results

Professional credibility is built through demonstrated competence, consistent adherence to standards, and reliable delivery of quality results.

Question 16: An organization's breach response team should include representatives from which departments to be most effective?

Legal, IT Security, Communications, and Executive Leadership (Correct answer)
Legal, IT Security, and HR only
Privacy, IT Security, and Finance only
IT Security and Legal only

Correct answer: Legal, IT Security, Communications, and Executive Leadership

Effective breach response requires coordination among Legal (liability/notification), IT Security (containment/forensics), Communications (PR/messaging), and Executive Leadership (decisions/resources).

Question 17: How does ongoing professional development support legal research & case analysis in Privacy Law?

It is irrelevant to compliance outcomes
It keeps professionals informed of evolving standards and best practices (Correct answer)
It only benefits entry-level professionals
It replaces the need for formal compliance audits

Correct answer: It keeps professionals informed of evolving standards and best practices

Ongoing professional development ensures that practitioners stay current with evolving regulations, standards, and best practices in their field.

Question 18: Under the California Consumer Privacy Act (CCPA), businesses that suffer a data breach exposing consumers' unencrypted personal information may face statutory damages of how much per consumer, per incident?

$100 to $750 (Correct answer)
$250 to $2,500
$500 to $5,000
$1,000 to $10,000

Correct answer: $100 to $750

The CCPA allows affected consumers to seek statutory damages between $100 and $750 per consumer per incident for data breaches of unencrypted personal information.

Question 19: Which right involves receiving personal data in a machine-readable format?

Right to erasure
Right to object
Right to data portability (Correct answer)
Right to access

Correct answer: Right to data portability

The Right to Data Portability allows individuals to obtain and reuse their personal data for their own purposes across different services. It enables them to receive their personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another data controller without hindrance. This promotes competition and user control over their digital footprint.

Question 20: The accountability principle requires organizations to:

Ignore breach notifications
Store data indefinitely
Publish all data publicly
Demonstrate compliance (Correct answer)

Correct answer: Demonstrate compliance

The accountability principle under GDPR requires organizations to not only comply with data protection principles but also to be able to demonstrate that compliance. This involves implementing robust data protection policies, maintaining records of processing activities, and conducting impact assessments. It shifts the burden of proof to the data controller to show they are upholding privacy standards.

Question 21: Under GDPR Article 25, 'data protection by design and by default' requires controllers to implement appropriate technical measures at what point?

At the time of determining means of processing AND at the time of processing itself (Correct answer)
Only before launching a new product to market
Only when processing special category data
After completing a Data Protection Impact Assessment

Correct answer: At the time of determining means of processing AND at the time of processing itself

GDPR Article 25 requires controllers to implement privacy-protective measures both when designing the processing system and during the actual processing of personal data.

Question 22: What enforcement action can the FTC take against companies violating privacy agreements?

Issue consent decrees (Correct answer)
Revoke business licenses
Issue tax audits
Impose import tariffs

Correct answer: Issue consent decrees

When the FTC finds that a company has violated privacy agreements or engaged in deceptive privacy practices, it often resolves the matter by issuing a consent decree. A consent decree is a legally binding agreement that outlines specific actions the company must take to remedy the violation and prevent future occurrences, often including regular privacy audits and reporting requirements. Failure to comply with a consent decree can result in additional, significant penalties.

Question 23: Which right allows individuals to request a copy of their personal data?

Right to rectify
Right to access (Correct answer)
Right to be informed
Right to object

Correct answer: Right to access

The Right to Access allows individuals to obtain confirmation as to whether their personal data is being processed, and if so, to access that data and supplementary information. This empowers individuals to understand what information an organization holds about them and how it is being used. It is a fundamental right for data subjects to maintain control over their personal information.

Question 24: Which client communication & advocacy technique is MOST appropriate when delivering complex information in Privacy Law?

Assuming the audience will research details independently
Using only written materials without verbal explanation
Presenting all information at once to save time
Breaking information into manageable segments and confirming understanding (Correct answer)

Correct answer: Breaking information into manageable segments and confirming understanding

Breaking information into manageable segments and checking understanding ensures comprehension and retention of complex material.

Question 25: Which element is ESSENTIAL for an effective legal research & case analysis program in Privacy Law?

Regular audits and continuous monitoring processes (Correct answer)
Annual review without interim checks
Compliance responsibility assigned to one individual only
Documentation stored without regular updates

Correct answer: Regular audits and continuous monitoring processes

Regular audits and continuous monitoring enable early detection of compliance gaps and ensure ongoing adherence to standards.

Question 26: Which principle gives users the ability to withdraw consent at any time?

Right to portability
Right to object
Right to withdraw consent (Correct answer)
Right to be informed

Correct answer: Right to withdraw consent

A fundamental aspect of valid consent under privacy laws like GDPR is that individuals must have the right to withdraw their consent at any time. This means that if they initially agreed to data processing, they can later revoke that permission, and the organization must cease processing their data based on that consent. This ensures ongoing control over personal information.

Question 27: Which barrier MOST commonly hinders effective client communication & advocacy in Privacy Law?

Over-communicating important information
Lack of active listening and assumptions about understanding (Correct answer)
Using too many communication channels
Providing too much context for messages

Correct answer: Lack of active listening and assumptions about understanding

Failure to actively listen and making assumptions about understanding are the most common barriers to effective communication.

Question 28: What is the PRIMARY objective of ethics & professional responsibility in the Privacy Law field?

To ensure adherence to established standards and protect stakeholders (Correct answer)
To create additional paperwork for professionals
To limit the scope of professional practice
To increase operational costs for organizations

Correct answer: To ensure adherence to established standards and protect stakeholders

The primary objective of compliance and regulatory frameworks is to ensure adherence to standards that protect stakeholders.

Question 29: Under HIPAA, covered entities must notify affected individuals of a breach affecting their protected health information within how many days of discovering the breach?

30 days
90 days
45 days
60 days (Correct answer)

Correct answer: 60 days

HIPAA's Breach Notification Rule requires covered entities to notify affected individuals within 60 days of discovering a breach of unsecured PHI.

Question 30: What is the MOST effective way to stay current with developments in document preparation & filing for Privacy Law?

Participating in professional development, industry events, and peer collaboration (Correct answer)
Reading only internal communications
Relying on experience gained early in career
Following a single expert opinions

Correct answer: Participating in professional development, industry events, and peer collaboration

A multi-faceted approach including formal development, industry events, and peer collaboration provides the broadest perspective on current developments.

Question 31: In Privacy Law, which factor MOST influences the selection of appropriate courtroom procedures & protocols?

The most recently developed technique only
Personal preference of the practitioner
The specific requirements and constraints of the situation (Correct answer)
Cost as the sole determining factor

Correct answer: The specific requirements and constraints of the situation

The specific requirements and constraints of each situation should drive technique selection to ensure the most effective and appropriate approach.

Question 32: Under the Electronic Communications Privacy Act (ECPA), which exception allows employers to monitor employee communications on company-owned networks without employee consent?

Emergency exception
Law enforcement exception
Business necessity exception
Provider exception (Correct answer)

Correct answer: Provider exception

The provider exception allows employers who own and operate the communication system to monitor its use without needing employee consent.

Question 33: Data integrity & confidentiality fall under which data processing principle?

Integrity & confidentiality (Correct answer)
Minimization
Transparency
Lawfulness

Correct answer: Integrity & confidentiality

The principle of integrity and confidentiality, often referred to as 'security,' mandates that personal data be processed in a manner that ensures appropriate security. This includes protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using suitable technical or organizational measures. It safeguards data from breaches and ensures its trustworthiness.

Question 34: Which of the following best describes 'privacy theater' — a concept privacy professionals must help organizations avoid?

Theatrical presentations used in privacy awareness training
Implementing visible but ineffective privacy measures that create a false appearance of compliance (Correct answer)
Public advocacy campaigns promoting consumer privacy rights
Staging mock privacy audits for employee training

Correct answer: Implementing visible but ineffective privacy measures that create a false appearance of compliance

Privacy theater refers to cosmetic compliance measures — like dense privacy policies or cookie banners — that appear protective but do not meaningfully reduce privacy risks or respect user rights.

Question 35: Consent must be as easy to withdraw as it was to:

Obtain passively
Ignore
Store
Provide (Correct answer)

Correct answer: Provide

A key requirement for valid consent under GDPR is that it must be as easy for an individual to withdraw their consent as it was to provide it. This ensures that individuals retain control over their personal data and are not trapped into ongoing processing once they have given permission. It prevents organizations from making withdrawal unnecessarily difficult, upholding user autonomy.

Question 36: When facing an unfamiliar challenge in document preparation & filing within Privacy Law, what is the BEST approach?

Attempt to resolve it independently without consultation
Apply the most familiar technique regardless of suitability
Research established best practices, consult colleagues, and document the approach (Correct answer)
Avoid the challenge if possible

Correct answer: Research established best practices, consult colleagues, and document the approach

Researching best practices and consulting colleagues combines established knowledge with practical experience, while documentation supports future reference.

Question 37: What makes consent valid under GDPR?

Assumed unless objected
Bundled with terms and conditions
Freely given and informed (Correct answer)
Requested after processing

Correct answer: Freely given and informed

Under GDPR, valid consent must be freely given, specific, informed, and unambiguous. This means individuals must have a genuine choice without pressure, understand exactly what they are consenting to, and provide a clear affirmative action. Bundled consent or assumed consent is generally not considered valid, ensuring the individual's true intent.

Question 38: What is the PRIMARY objective of regulatory frameworks & compliance in the Privacy Law field?

To increase operational costs for organizations
To ensure adherence to established standards and protect stakeholders (Correct answer)
To create additional paperwork for professionals
To limit the scope of professional practice

Correct answer: To ensure adherence to established standards and protect stakeholders

The primary objective of compliance and regulatory frameworks is to ensure adherence to standards that protect stakeholders.

Question 39: When facing an unfamiliar challenge in contract review & negotiation within Privacy Law, what is the BEST approach?

Apply the most familiar technique regardless of suitability
Research established best practices, consult colleagues, and document the approach (Correct answer)
Attempt to resolve it independently without consultation
Avoid the challenge if possible

Correct answer: Research established best practices, consult colleagues, and document the approach

Researching best practices and consulting colleagues combines established knowledge with practical experience, while documentation supports future reference.

Question 40: Under the California Privacy Rights Act (CPRA), businesses must conduct cybersecurity audits and risk assessments when their processing poses what type of risk?

Significant risk to consumers' privacy or security (Correct answer)
Any risk involving more than 10,000 consumers
Risk involving sensitive personal information only
Risk to minors under age 16 only

Correct answer: Significant risk to consumers' privacy or security

The CPRA requires the California Privacy Protection Agency to establish regulations mandating audits and risk assessments for processing that poses significant privacy or security risks.

Question 41: How does ongoing professional development support regulatory frameworks & compliance in Privacy Law?

It replaces the need for formal compliance audits
It keeps professionals informed of evolving standards and best practices (Correct answer)
It is irrelevant to compliance outcomes
It only benefits entry-level professionals

Correct answer: It keeps professionals informed of evolving standards and best practices

Ongoing professional development ensures that practitioners stay current with evolving regulations, standards, and best practices in their field.

Question 42: Under the FTC's framework for the Internet of Things (IoT), which of the following is a recommended privacy best practice for IoT device manufacturers?

Storing all user data on domestic US servers only
Requiring annual user reconsent for all data processing
Collecting all available sensor data to improve future functionality
Building security into devices at the design stage and minimizing data collection (Correct answer)

Correct answer: Building security into devices at the design stage and minimizing data collection

The FTC's IoT guidance recommends security by design and data minimization as key practices, limiting collection to data reasonably necessary for the product's functionality.

Question 43: Under what circumstances may an employer have the strongest legal basis for accessing an employee's personal email account?

Only with a valid court order or legal process in all circumstances
Whenever the employee uses it for any work-related communication
At any time the employer suspects workplace misconduct
When accessed on company equipment and a written policy permits such access (Correct answer)

Correct answer: When accessed on company equipment and a written policy permits such access

When employees access personal email on company equipment and the employer has a clearly communicated written policy, the employer's access claim is strongest, though accessing truly personal accounts still typically requires legal process.

Question 44: What is the PRIMARY objective of document preparation & filing within the Privacy Law profession?

To limit the scope of professional activities
To ensure quality outcomes through standardized practices and continuous improvement (Correct answer)
To create additional requirements for practitioners
To maintain the status quo without change

Correct answer: To ensure quality outcomes through standardized practices and continuous improvement

The primary objective is ensuring quality outcomes through established standards while continuously improving practices and processes.

Question 45: What is the MOST effective way to stay current with developments in contract review & negotiation for Privacy Law?

Following a single expert opinions
Reading only internal communications
Participating in professional development, industry events, and peer collaboration (Correct answer)
Relying on experience gained early in career

Correct answer: Participating in professional development, industry events, and peer collaboration

A multi-faceted approach including formal development, industry events, and peer collaboration provides the broadest perspective on current developments.

Question 46: Under GDPR, data must be accurate and kept up to date. Which principle does this reflect?

Data integrity
Security
Accuracy (Correct answer)
Accountability

Correct answer: Accuracy

The accuracy principle under GDPR mandates that personal data must be accurate and, where necessary, kept up to date. This ensures that decisions made about individuals are based on correct information and prevents harm that could arise from processing outdated or incorrect data. Organizations are responsible for taking reasonable steps to ensure data integrity.

Question 47: What principle requires that personal data be collected for specified, legitimate purposes?

Accuracy
Purpose limitation (Correct answer)
Accountability
Data minimization

Correct answer: Purpose limitation

The principle of purpose limitation requires that personal data be collected for specified, explicit, and legitimate purposes. This means organizations cannot collect data for one reason and then use it for unrelated purposes without further justification or consent. It ensures transparency and prevents the arbitrary use of personal information.

Question 48: Which phase of NIST's incident response lifecycle involves activities to stop the spread of an incident and prevent further damage?

Detection and Analysis
Containment, Eradication, and Recovery (Correct answer)
Preparation
Post-Incident Activity

Correct answer: Containment, Eradication, and Recovery

The Containment, Eradication, and Recovery phase focuses on stopping the incident spread, removing the threat, and restoring normal operations.

Question 49: What principle mandates that personal data not be kept longer than necessary?

Integrity
Lawfulness
Minimization
Storage limitation (Correct answer)

Correct answer: Storage limitation

The storage limitation principle dictates that personal data should not be kept longer than is necessary for the purposes for which it was collected. Once the purpose is fulfilled, the data should be securely deleted or anonymized. This prevents indefinite retention of personal information and reduces the risk associated with holding outdated data.

Question 50: Under FTC Act Section 5, failure to maintain reasonable security measures that leads to a data breach can be considered:

A criminal offense requiring DOJ prosecution
A violation only if negligence is proven
A strict liability tort
An unfair or deceptive trade practice (Correct answer)

Correct answer: An unfair or deceptive trade practice

The FTC has consistently held that inadequate data security practices that result in consumer harm constitute unfair or deceptive acts or practices under FTC Act Section 5.

Question 51: Which of the following is a legal basis for processing personal data under GDPR?

Right to object
Consent (Correct answer)
Data portability
Public availability

Correct answer: Consent

Under GDPR, consent is one of the primary legal bases for processing personal data. It means individuals have given clear, affirmative permission for their data to be processed for specific purposes. Other legal bases include contractual necessity, legal obligation, vital interests, public task, and legitimate interests, but consent empowers individuals with direct control.

Question 52: Which of the following employee records is generally NOT subject to heightened confidentiality requirements under U.S. federal privacy law?

Medical examination results obtained during employment
Genetic test results disclosed to an employer
Performance review ratings shared through normal HR management processes (Correct answer)
Workers' compensation claim details and related medical information

Correct answer: Performance review ratings shared through normal HR management processes

Performance review ratings shared within normal HR and management processes are not subject to the same heightened confidentiality protections that apply to medical, genetic, or workers' compensation information.

Question 53: The Employee Polygraph Protection Act (EPPA) generally prohibits private employers from:

Accessing employee medical records
Requiring or requesting lie detector tests (Correct answer)
Conducting background checks on applicants
Monitoring employee internet usage

Correct answer: Requiring or requesting lie detector tests

The EPPA prohibits most private employers from using lie detector tests for pre-employment screening or during employment, with limited exceptions for certain industries.

Question 54: What is the primary privacy concern with 'cookie walls' — requiring users to accept all cookies or be denied access to a website?

They undermine the freely given nature of consent required by GDPR and state laws (Correct answer)
They are prohibited by the CFPB's consumer financial protection rules
They violate CCPA's right to opt out of sale
They create ADA accessibility violations

Correct answer: They undermine the freely given nature of consent required by GDPR and state laws

Regulators have found that cookie walls coerce consent, making it not 'freely given' as required by GDPR and similar state privacy laws, because users have no real choice.

Question 55: Which right allows individuals to request deletion of their data?

Right to restrict
Right to object
Right to erasure (Correct answer)
Right to rectify

Correct answer: Right to erasure

The Right to Erasure, often called the 'Right to be Forgotten,' allows individuals to request the deletion or removal of their personal data where there is no compelling reason for its continued processing. This right applies in specific circumstances, such as when the data is no longer necessary for the purpose for which it was collected or when consent is withdrawn. It empowers individuals to control their digital footprint.

Question 56: Which principle emphasizes collecting only data necessary for the purpose?

Data minimization (Correct answer)
Lawfulness
Transparency
Storage limitation

Correct answer: Data minimization

Data minimization is a core privacy principle emphasizing that organizations should collect and process only the personal data that is absolutely necessary for the specified purpose. This reduces the amount of sensitive information held, thereby lowering the risk in case of a data breach and limiting potential misuse. It promotes a 'less is more' approach to data handling.

Question 57: Which US federal law requires financial institutions to notify customers of a security breach involving their personal financial information?

Fair Credit Reporting Act
Gramm-Leach-Bliley Act (GLBA) (Correct answer)
Electronic Communications Privacy Act
Sarbanes-Oxley Act

Correct answer: Gramm-Leach-Bliley Act (GLBA)

The GLBA Safeguards Rule requires financial institutions to notify affected customers when their personal financial information is breached.

Question 58: What must organizations do before transferring data using SCCs?

Conduct a Transfer Impact Assessment (Correct answer)
Use Privacy Shield
Obtain ISO certification
Notify the European Commission

Correct answer: Conduct a Transfer Impact Assessment

Following the Schrems II ruling, organizations using Standard Contractual Clauses (SCCs) are now required to conduct a Transfer Impact Assessment (TIA). This assessment evaluates whether the laws and practices of the recipient country might undermine the protections guaranteed by the SCCs, particularly regarding government access to data. If risks are identified, supplementary measures must be implemented to ensure an equivalent level of protection for the transferred data.

Question 59: Which action BEST demonstrates a commitment to legal research & case analysis in Privacy Law?

Relying on colleagues to interpret regulatory requirements
Following only the regulations that are convenient
Maintaining current knowledge of all applicable regulations and standards (Correct answer)
Addressing compliance issues only when audited

Correct answer: Maintaining current knowledge of all applicable regulations and standards

Actively maintaining current knowledge of applicable regulations demonstrates genuine commitment to compliance and helps prevent violations.

Question 60: What is a 'Data Protection Impact Assessment' (DPIA), and when is it required under GDPR?

An employee training record required when processing HR data
A financial audit of data protection costs, required annually
A compliance checklist required for all new products
A systematic risk assessment required before high-risk processing activities (Correct answer)

Correct answer: A systematic risk assessment required before high-risk processing activities

A DPIA is a systematic process to identify and minimize data protection risks, required under GDPR Article 35 before engaging in processing likely to result in high risk to individuals.

Question 61: How does ongoing professional development support ethics & professional responsibility in Privacy Law?

It is irrelevant to compliance outcomes
It keeps professionals informed of evolving standards and best practices (Correct answer)
It only benefits entry-level professionals
It replaces the need for formal compliance audits

Correct answer: It keeps professionals informed of evolving standards and best practices

Ongoing professional development ensures that practitioners stay current with evolving regulations, standards, and best practices in their field.

Question 62: Which user right involves correction of inaccurate personal data?

Right to restrict processing
Right to erasure
Right to portability
Right to rectification (Correct answer)

Correct answer: Right to rectification

The Right to Rectification allows individuals to request that inaccurate personal data concerning them be corrected without undue delay. If the data is incomplete, they also have the right to have it completed, taking into account the purposes of the processing. This ensures the accuracy and fairness of personal information, preventing harm from incorrect data.

Question 63: What is required before processing personal data under consent basis?

Explicit opt-in (Correct answer)
Passive browsing
Pre-checked boxes
Implied through use

Correct answer: Explicit opt-in

For consent to be valid under GDPR, it generally requires an explicit opt-in, meaning individuals must take a clear, affirmative action to indicate their agreement. Pre-checked boxes, passive browsing, or implied consent are typically not sufficient. This ensures that consent is unambiguous and genuinely reflects the individual's informed choice, giving them true control.

Question 64: In Privacy Law, what is the MOST appropriate response when a potential compliance violation is discovered?

Address it only if a supervisor specifically asks about it
Wait to see if the violation causes harm before reporting
Discuss it informally without documentation
Report it immediately through established channels and document findings (Correct answer)

Correct answer: Report it immediately through established channels and document findings

Immediate reporting through established channels with proper documentation ensures timely resolution and maintains the integrity of the compliance program.

Question 65: Which term describes the process of preserving digital evidence in a forensically sound manner following a data breach?

Chain of custody (Correct answer)
Privilege log
Data minimization
Litigation hold

Correct answer: Chain of custody

Chain of custody refers to the documented process of collecting, preserving, and handling digital evidence so it remains admissible and unaltered.

Question 66: What mechanism is commonly used under GDPR for lawful data transfers outside the EU?

EU Safe Harbor
Voluntary Codes of Conduct
Standard Contractual Clauses (Correct answer)
Privacy Badge

Correct answer: Standard Contractual Clauses

Standard Contractual Clauses (SCCs) are pre-approved model clauses provided by the European Commission that organizations can use to legally transfer personal data from the EU/EEA to countries not deemed to offer adequate data protection. They impose contractual obligations on both the data exporter and importer to ensure appropriate safeguards for the transferred data. SCCs are a widely used mechanism to comply with GDPR's requirements for international data transfers.

Question 67: An organization's incident response plan (IRP) should be tested using tabletop exercises at minimum how often, according to NIST SP 800-61 guidance?

Quarterly
Monthly
Annually (Correct answer)
Every two years

Correct answer: Annually

NIST SP 800-61 recommends that incident response plans be reviewed and tested at least annually to ensure effectiveness and currency.

Question 68: The National Labor Relations Act (NLRA) protects employees' rights to discuss which of the following with coworkers?

Wages, hours, and working conditions (Correct answer)
Company financial projections not yet disclosed publicly
Confidential client information
Trade secrets and proprietary formulas

Correct answer: Wages, hours, and working conditions

The NLRA protects concerted activity, including employees' rights to discuss wages, hours, and working conditions among themselves, and employer policies restricting such discussion may be unlawful.

Question 69: What is a common consequence for companies that fail to comply with data protection regulations?

Tax incentives
Increased customer trust
Higher employee retention
Financial penalties and legal actions (Correct answer)

Correct answer: Financial penalties and legal actions

Companies that fail to comply with data protection regulations face severe consequences, including significant financial penalties imposed by regulatory authorities. Beyond fines, non-compliance can lead to legal actions from affected individuals, class-action lawsuits, and mandatory audits. These outcomes can severely impact a company's financial stability, reputation, and operational continuity.

Question 70: A US company experiences a breach affecting EU residents' data. Under GDPR, if the breach is unlikely to result in a risk to individuals' rights, the company must:

Notify the supervisory authority within 72 hours
Notify affected individuals immediately
Notify both the supervisory authority and individuals within 72 hours
Document the breach internally without notifying authorities (Correct answer)

Correct answer: Document the breach internally without notifying authorities

GDPR Article 33(1) states that breaches unlikely to result in risk to individuals' rights need not be reported to supervisory authorities but must be documented internally.

Question 71: Which action BEST demonstrates a commitment to regulatory frameworks & compliance in Privacy Law?

Addressing compliance issues only when audited
Maintaining current knowledge of all applicable regulations and standards (Correct answer)
Following only the regulations that are convenient
Relying on colleagues to interpret regulatory requirements

Correct answer: Maintaining current knowledge of all applicable regulations and standards

Actively maintaining current knowledge of applicable regulations demonstrates genuine commitment to compliance and helps prevent violations.

Question 72: How should unexpected results during courtroom procedures & protocols be handled in Privacy Law?

Document the findings, analyze potential causes, and consult protocols (Correct answer)
Ignore results that do not match expectations
Repeat the procedure until desired results are achieved
Attribute unexpected results to equipment error automatically

Correct answer: Document the findings, analyze potential causes, and consult protocols

Documenting unexpected findings, analyzing causes, and consulting established protocols ensures proper investigation and appropriate response.

Question 73: Which factor BEST indicates mastery of document preparation & filing in Privacy Law?

Years of experience in a single setting
The ability to adapt knowledge and skills to varying contexts while maintaining standards (Correct answer)
Number of certifications held
Speed of task completion

Correct answer: The ability to adapt knowledge and skills to varying contexts while maintaining standards

True mastery is demonstrated by the ability to apply knowledge flexibly across different contexts while consistently maintaining quality standards.

Question 74: The legal concept of 'legitimate expectation of privacy' in the workplace is evaluated by:

Whether the expectation was both subjectively held and objectively reasonable given the work context (Correct answer)
Whether the employer has an explicit written policy covering every monitored activity
Whether the employee signed a waiver of all privacy rights upon hiring
Whether the employee subjectively felt their activities were private

Correct answer: Whether the expectation was both subjectively held and objectively reasonable given the work context

Courts analyze workplace privacy claims by determining whether the employee had a subjective expectation of privacy that society would recognize as objectively reasonable given the specific work environment and context.

Question 75: What is the PRIMARY objective of dispute resolution & mediation within the Privacy Law profession?

To create additional requirements for practitioners
To limit the scope of professional activities
To maintain the status quo without change
To ensure quality outcomes through standardized practices and continuous improvement (Correct answer)

Correct answer: To ensure quality outcomes through standardized practices and continuous improvement

The primary objective is ensuring quality outcomes through established standards while continuously improving practices and processes.

Question 76: Which US state was the FIRST to enact a data breach notification law, creating a model that most other states subsequently followed?

Texas
New York
Massachusetts
California (Correct answer)

Correct answer: California

California enacted the first US state data breach notification law (SB 1386) in 2002, which became the template for nearly all subsequent state laws.

Question 77: Under the FCRA's 'adverse action' process, when an employer intends to deny employment based on a background check report, the employer must first:

Obtain court approval before making the adverse employment decision
Provide a pre-adverse action notice with a copy of the report and Summary of Consumer Rights (Correct answer)
Report the adverse decision to the relevant state labor department
Notify the applicant only after the final decision has been communicated

Correct answer: Provide a pre-adverse action notice with a copy of the report and Summary of Consumer Rights

The FCRA requires a two-step adverse action process: a pre-adverse action notice with the consumer report and Summary of Rights, followed by a final adverse action notice after a reasonable waiting period.

Question 78: In Privacy Law, what is the MOST effective approach to client communication & advocacy?

Using technical terminology exclusively
Active listening combined with clear, empathetic communication (Correct answer)
Communicating only in writing to avoid misunderstandings
Providing information without seeking feedback

Correct answer: Active listening combined with clear, empathetic communication

Active listening combined with clear, empathetic communication builds trust and ensures mutual understanding between all parties.

Question 79: Transparency in data collection ensures that:

Consent is optional
Organizations collect data anonymously
Individuals know how their data is used (Correct answer)
Data is hidden from users

Correct answer: Individuals know how their data is used

Transparency in data collection ensures that individuals are clearly informed about what data is being collected, why it's being collected, how it will be used, and who it will be shared with. This empowers individuals to make informed decisions about their personal data and exercise their rights. It builds trust and promotes fair and lawful processing.

Question 80: A company's mobile app collects location data continuously in the background. Under the principle of 'purpose limitation,' this practice is problematic because:

GPS data is considered sensitive under GLBA
Location data is categorically prohibited under US federal law
The data may be used for purposes beyond what users were told at collection (Correct answer)
Background collection always requires DPIA under COPPA

Correct answer: The data may be used for purposes beyond what users were told at collection

Purpose limitation requires that personal data be collected for specified, explicit purposes and not further processed in ways incompatible with those original purposes.

Question 81: What does the term 'safe harbor' mean in the context of US data breach notification laws?

A federal preemption of state notification requirements
A limit on damages available in breach lawsuits
An exemption from notification if the breached data was encrypted (Correct answer)
A grace period before notification must occur

Correct answer: An exemption from notification if the breached data was encrypted

Most US state breach notification laws provide a safe harbor exempting organizations from notification obligations when the exposed data was encrypted and the encryption key was not also compromised.

Question 82: Employer wellness programs that require employees to complete health risk assessments or biometric screenings must comply with:

Only applicable state privacy laws
HIPAA, ADA, and GINA provisions, depending on the program's design (Correct answer)
Only FCRA disclosure and authorization requirements
Only the Electronic Communications Privacy Act (ECPA)

Correct answer: HIPAA, ADA, and GINA provisions, depending on the program's design

Employer wellness programs must navigate HIPAA privacy rules for health data, ADA restrictions on disability-related inquiries, and GINA limits on genetic information collection, depending on the program's structure.

Question 83: Which factor BEST indicates mastery of dispute resolution & mediation in Privacy Law?

Years of experience in a single setting
Number of certifications held
The ability to adapt knowledge and skills to varying contexts while maintaining standards (Correct answer)
Speed of task completion

Correct answer: The ability to adapt knowledge and skills to varying contexts while maintaining standards

True mastery is demonstrated by the ability to apply knowledge flexibly across different contexts while consistently maintaining quality standards.

Question 84: When an employee returns from FMLA leave, their medical certification and related health information must be:

Shared with the employee's direct supervisor to facilitate return-to-work planning
Kept in a separate confidential medical file, apart from the general personnel file (Correct answer)
Disclosed to HR and senior management but not line supervisors
Retained in the general personnel file with role-based access controls

Correct answer: Kept in a separate confidential medical file, apart from the general personnel file

FMLA regulations, consistent with ADA requirements, mandate that employee medical information be maintained in separate confidential files distinct from general personnel records.

Question 85: What is required for consent to be valid under privacy regulations?

Requested after processing
Implied by default
Given automatically
Freely given and informed (Correct answer)

Correct answer: Freely given and informed

For consent to be valid under privacy regulations like GDPR, it must be freely given, specific, informed, and unambiguous. 'Freely given' means without coercion, and 'informed' means the individual understands what they are consenting to, including the purpose of processing and their right to withdraw. This ensures genuine choice and control for the individual over their data.

Question 86: Which document typically outlines how and why user data is collected and used?

Privacy policy (Correct answer)
Cookie banner
Security notice
Terms of service

Correct answer: Privacy policy

A privacy policy is a legal document that explicitly informs users about how an organization collects, uses, stores, and protects their personal data. It details the types of data gathered, the purposes for collection, data sharing practices, and user rights regarding their information. This transparency is crucial for compliance with data protection laws and building user trust.

Question 87: When is explicit consent required for international data transfer?

When no safeguards apply (Correct answer)
If data is anonymized
When a TIA exists
If a DPO signs off

Correct answer: When no safeguards apply

Under GDPR, explicit consent is generally required for international data transfers only as a derogation (exception) when no other appropriate safeguards, such as adequacy decisions, Standard Contractual Clauses, or Binding Corporate Rules, are in place. This means that if an organization cannot rely on any other legal basis or safeguard, they must obtain explicit, informed, and specific consent from the data subject for the transfer. This is typically a last resort due to the high bar for explicit consent.

Question 88: Under the concept of 'Privacy by Default,' what should the default settings of a new application be configured to?

Maximum data sharing to improve user experience
The most privacy-protective settings, requiring users to opt in for additional sharing (Correct answer)
Settings determined by the marketing team's data needs
Settings mandated by the industry's self-regulatory body

Correct answer: The most privacy-protective settings, requiring users to opt in for additional sharing

Privacy by Default means that without any action by the user, only the minimum necessary data is processed, and the strictest privacy settings are active out of the box.

Question 89: When addressing difficult situations through client communication & advocacy in Privacy Law, what strategy is BEST?

Responding defensively to protect professional reputation
Acknowledging concerns, providing clear information, and offering solutions (Correct answer)
Minimizing the significance of the issue
Avoiding the conversation until the situation resolves itself

Correct answer: Acknowledging concerns, providing clear information, and offering solutions

Acknowledging concerns validates the other party experience, clear information builds trust, and offering solutions demonstrates commitment to resolution.

Question 90: What consequence can result from failing to maintain proper ethics & professional responsibility standards in Privacy Law?

Loss of certification, legal penalties, and reputational damage (Correct answer)
Increased customer satisfaction
Lower training requirements
Reduced workload for staff

Correct answer: Loss of certification, legal penalties, and reputational damage

Non-compliance can result in serious consequences including certification revocation, legal penalties, fines, and significant reputational damage.

Privacy Law Certification (PLC)

The Privacy Law Certification (PLC) validates expertise in privacy law, data protection regulations, and legal practice. It covers GDPR, CCPA, consent frameworks, breach response, and professional conduct for attorneys and privacy legal practitioners.

Questions

150 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds