Question 1

SCENARIO

Please use the following to answer the next question:

Henry Home Furnishings has built high-end furniture for nearly forty years. However, the new owner, Anton, has

found some degree of disorganization after touring the company headquarters. His uncle Henry had always

focused on production – not data processing – and Anton is concerned. In several storage rooms, he has found

paper files, disks, and old computers that appear to contain the personal data of current and former employees

and customers. Anton knows that a single break-in could irrevocably damage the company's relationship with

its loyal customers. He intends to set a goal of guaranteed zero loss of personal information.

To this end, Anton originally planned to place restrictions on who was admitted to the physical premises of the

company. However, Kenneth – his uncle's vice president and longtime confidante – wants to hold off on Anton's

idea in favor of converting any paper records held at the company to electronic storage. Kenneth believes this

process would only take one or two years. Anton likes this idea; he envisions a password-protected system that

only he and Kenneth can access.

Anton also plans to divest the company of most of its subsidiaries. Not only will this make his job easier, but it

will simplify the management of the stored data. The heads of subsidiaries like the art gallery and kitchenware

store down the street will be responsible for their own information management. Then, any unneeded subsidiary

data still in Anton's possession can be destroyed within the next few years.

After learning of a recent security incident, Anton realizes that another crucial step will be notifying customers.

Kenneth insists that two lost hard drives in question are not cause for concern; all of the data was encrypted

and not sensitive in nature. Anton does not want to take any chances, however. He intends on sending notice

letters to all employees and customers to be safe.

Anton must also check for compliance with all legislative, regulatory, and market requirements related to

privacy protection. Kenneth oversaw the development of the company's online presence about ten years ago,

but Anton is not confident about his understanding of recent online marketing laws. Anton is assigning another

trusted employee with a law background the task of the compliance assessment. After a thorough analysis,

Anton knows the company should be safe for another five years, at which time he can order another check.

Documentation of this analysis will show auditors due diligence.

Anton has started down a long road toward improved management of the company, but he knows the effort is

worth it. Anton wants his uncle's legacy to continue for many years to come.

In terms of compliance with regulatory and legislative changes, Anton has a misconception regarding?

Options :

A : The timeline for monitoring.

B : The method of recordkeeping

C : The use of internal employees

D : The type of required qualifications.

Answer: A

Question 2

Under the General Data Protection Regulation (GDPR), international data transfer is allowed using the mechanisms in all of the following scenarios EXCEPT between companies who?

Options :

A : Are part of the same group of enterprise using approved Binding Corporate Rules (BCRs).

B : Have signed up to the EU Standard Contractual Clauses.

C : Have put in place a binding confidentiality agreement.

D : Have put in place an approved code of conduct.

Answer: C

Question 3

SCENARIO

Please use the following to answer the next question.

Manasa is a product manager at Omnipresent Omnimedia, where she is responsible for leading the

development of the company’s flagship product, the Handy Helper. The Handy Helper is an application that can

be used in the home to manage family calendars, do online shopping, and schedule doctor appointments. After

having had a successful launch in the United States, the Handy Helper is about to be made available for

purchase worldwide.

The packaging and user guide for the Handy Helper indicate that it is a “privacy friendly” product suitable for the

whole family, including children, but does not provide any further detail or privacy notice. In order to use the

application, a family creates a single account, and the primary user has access to all information about the

other users. Upon start up, the primary user must check a box consenting to receive marketing emails from

Omnipresent Omnimedia and selected marketing partners in order to be able to use the application.

Sanjay, the head of privacy at Omnipresent Omnimedia, was working on an agreement with a European

distributor of Handy Helper when he fielded many questions about the product from the distributor. Sanjay

needed to look more closely at the product in order to be able to answer the questions as he was not involved

in the product development process.

In speaking with the product team, he learned that the Handy Helper collected and stored all of a user’s

sensitive medical information for the medical appointment scheduler. In fact, all of the user’s information is

stored by Handy Helper for the additional purpose of creating additional products and to analyze usage of the

product. This data is all stored in the cloud and is encrypted both during transmission and at rest.

Consistent with the CEO’s philosophy that great new product ideas can come from anyone, all Omnipresent

Omnimedia employees have access to user data under a program called “Eureka.” Omnipresent Omnimedia is

hoping that at some point in the future, the data will reveal insights that could be used to create a fully

automated application that runs on artificial intelligence, but as of yet, Eureka is not well-defined and is

considered a long-term goal.

What security controls are missing from the Eureka program?

Options :

A : Storage of medical data in the cloud is not permissible under the General Data Protection Regulation (GDPR)

B : Data access is not limited to those who “need to know” for their role

C : Collection of data without a defined purpose might violate the fairness principle

D : Encryption of the data at rest prevents European users from having the right of access and the right of portability of their data

Answer: B

Question 4

The most direct way to ensure you are effectively communicating your privacy mission throughout your organization is to?

Options :

A : Ensure marketing activity is adequately resourced.

B : Evaluate the content in your privacy awareness program.

C : Survey buy-in from your team and stakeholders on a privacy strategy.

D : Review the quantity of Data Protection Impact Assessments (DPIAs) to ensure completeness for every project.

Answer: B,C

Question 5

Which aspect of a privacy program can best aid an organization’s response time to a Data Subject Access Request (DSAR)?

Options :

A : Conducting privacy training

B : Maintaining a written DSAR policy

C : Creating a comprehensive data inventory

D : Implementing Privacy Impact Assessment (PIAs).

Answer: B,C