IAPP CIPM Actual Tests : Certified Information Privacy Manager (CIPM)

SCENARIO
Please use the following to answer the next QUESTION:
Richard McAdams recently graduated law school and decided to return to the small town of Lexington, Virginia to help run his aging grandfather's law practice. The elder McAdams desired a limited, lighter role in the practice, with the hope that his grandson would eventually take over when he fully retires. In addition to hiring Richard, Mr. McAdams employs two paralegals, an administrative assistant, and a part-time IT specialist who handles all of their basic networking needs. He plans to hire more employees once Richard gets settled and assesses the office's strategies for growth.
Immediately upon arrival, Richard was amazed at the amount of work that needed to done in order to modernize the office, mostly in regard to the handling of clients' personal data. His first goal is to digitize all the records kept in file cabinets, as many of the documents contain personally identifiable financial and medical data. Also, Richard has noticed the massive amount of copying by the administrative assistant throughout the day, a practice that not only adds daily to the number of files in the file cabinets, but may create security issues unless a formal policy is firmly in place Richard is also concerned with the overuse of the communal copier/ printer located in plain view of clients who frequent the building. Yet another area of concern is the use of the same fax machine by all of the employees. Richard hopes to reduce its use dramatically in order to ensure that personal data receives the utmost security and protection, and eventually move toward a strict Internet faxing policy by the year's end.
Richard expressed his concerns to his grandfather, who agreed, that updating data storage, data security, and an overall approach to increasing the protection of personal data in all facets is necessary Mr. McAdams granted him the freedom and authority to do so. Now Richard is not only beginning a career as an attorney, but also functioning as the privacy officer of the small firm. Richard plans to meet with the IT employee the following day, to get insight into how the office computer system is currently set-up and managed.
Which of the following policy statements needs additional instructions in order to further protect the personal data of their clients?

• A. Before any copiers, printers, or fax machines are replaced or resold, the hard drives of these devices must be deleted before leaving the office.
• B. All unused copies, prints, and faxes must be discarded in a designated recycling bin located near the work station and emptied daily.
• C. When sending a print job containing personal data, the user must not leave the information visible on the computer screen following the print command and must retrieve the printed document immediately.
• D. All faxes sent from the office must be documented and the phone number used must be double checked to ensure a safe arrival.

Which is NOT an influence on the privacy environment external to an organization?

• A. Management team priorities.
• B. Technological advances.
• C. Regulations.
• D. Consumer demand.

Data retention and destruction policies should meet all of the following requirements EXCEPT?

• A. Data destruction triggers and methods should be documented.
• B. Documentation related to audit controls (third-party or internal) should be saved in a non-permanent format by default.
• C. The organization should be documenting and reviewing policies of its other functions to ensure alignment (e.g. HR, business development, finance, etc.).
• D. Personal information should be retained only for as long as necessary to perform its stated purpose.

According to the General Data Protection Regulation (GDPR), the requirements of a Data Protection Impact Assessment (DPIA) include that it?

• A. Be reported to the corresponding supervisory authority.
• B. Is required if the processing activity entails risk to the rights and freedoms of an EU individual.
• C. Provide a description of the proposed processing operation and its purpose.
• D. Publish the report to demonstrate the transparency of the data processing.

Which is TRUE about the scope and authority of data protection oversight authorities?

• A. The Office of the Privacy Commissioner (OPC) of Canada has the right to impose financial sanctions onviolators.
• B. All authority in the European Union rests with the Data Protection Commission (DPC).
• C. The Asia-Pacific Economic Cooperation (APEC) Privacy Frameworks require all member nations to designate a national data protection authority.
• D. No one agency officially oversees the enforcement of privacy regulations in the United States.