RCMS Data Privacy & Protection Compliance 3

Question 1

FERPA protects the educational records of students at institutions receiving federal funding. At what age do FERPA rights transfer from parents to the student?

Accepted Answer

18

Answer

FERPA rights transfer to the eligible student at age 18 or upon enrollment in a postsecondary institution.

Question 2

A Data Protection Impact Assessment (DPIA) under GDPR is mandatory when processing is likely to result in:

Accepted Answer

High risk to the rights and freedoms of natural persons

Answer

GDPR Article 35 requires a DPIA when processing is likely to result in a high risk to individuals' rights and freedoms, especially with new technologies.

Question 3

Under the Gramm-Leach-Bliley Act (GLBA), financial institutions must provide customers a privacy notice:

Accepted Answer

At account opening and annually thereafter

Answer

GLBA requires financial institutions to provide an initial privacy notice at the time of establishing a customer relationship and annually thereafter.

Question 4

Which principle from the OECD Privacy Guidelines requires that personal data should only be collected for specified, explicit purposes?

Accepted Answer

Purpose Specification Principle

Answer

The Purpose Specification Principle requires that the purposes for data collection be specified no later than at the time of collection.

Question 5

A compliance officer discovers that a third-party vendor is processing personal data beyond the scope of the signed data processing agreement. The FIRST corrective action should be:

Accepted Answer

Issue a formal cure notice and suspend processing pending remediation

Answer

The immediate step is to halt unauthorized processing and provide the vendor an opportunity to cure the breach per the contract terms.

(RCMS) Registered Compliance Management Specialist Certification Practice Test

(RCMS) Registered Compliance Management Specialist Certification Practice Test

RCMS Data Privacy & Protection Compliance 3