Privacy in the Modern Era

Which of the following types of information should be protected by a privacy program?

• Customer records

• Product plans

• Trade secrets

• All of the above

Answer explanation

All of these records are important to a business and may be considered sensitive. However, this does not mean that they would fall into the scope of a privacy program. Privacy programs are specifically intended to protect personal information and, of the information presented here, only customer records fall into that category. A cybersecurity program would be interested in protecting all these elements of information.

Barry is consulting with his organization's cybersecurity team on the development of their cybersecurity program. Which one of the following would not be a typical objective of such a program?

• 1. Privacy

• 1. Confidentiality

• 1. Availability

• 1. Integrity

Answer explanation

The three main goals of a cybersecurity program are confidentiality, integrity, and availability. Although privacy and security objectives are often linked and interdependent, privacy is not one of the three cybersecurity objectives.

Howard is assisting his firm in developing a new privacy program and wants to incorporate a privacy risk assessment process into the program. If Howard wishes to comply with industry best practices, how often should the firm conduct these risk assessments?

• 1. Monthly

• 1. Semiannually

• 1. Annually

• 1. Biannually

Answer explanation

1. Industry best practice calls for an annual privacy risk assessment designed to analyze the organization's current practices in light of the evolving privacy environment.

Of the following fields, which fits into the "special categories of personal data" under GDPR?

• 1. Banking records

• 1. Union membership records

• 1. Educational records

• 1. Employment records

Answer explanation

The special categories of information under GDPR include information about racial and ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information, health data, and data about a person's sex life or sexual orientation. Other categories of information may be sensitive but do not fit into this definition.

Katie is assessing her organization's privacy practices and determines that the organization previously collected customer addresses for the purpose of shipping goods and is now using those addresses to mail promotional materials. If this possibility was not previously disclosed, what privacy principle is the organization most likely violating?

• 1. Quality

• 1. Management

• 1. Notice

• 1. Security

Answer explanation

One of the provisions of the notice principle is that organizations should provide notice to data subjects before they use information for a purpose other than those that were previously disclosed.

Kara is the chief privacy officer of an organization that maintains a database of customer information for marketing purposes. What term best describes the role of Kara's organization with respect to that database?

• 1. Data subject

• 1. Data custodian

• 1. Data controller

• 1. Data processor

Answer explanation

1. Kara's organization is collecting and processing this information for its own business needs. Therefore, it is best described as the data controller.

Richard would like to use an industry standard reference for designing his organization's privacy controls. Which one of the following ISO standards is best suited for this purpose?

• 1. ISO 27001

• 1. ISO 27002

• 1. ISO 27701

• 1. ISO 27702

Answer explanation

ISO 27701 covers best practices for implementing privacy controls. ISO 27001 and ISO 27002 relate to an organization's information security program. ISO 27702 does not yet exist.

Which of the following organizations commonly requests a formal audit of a privacy program?

• 1. Management

• 1. Board of directors

• 1. Regulators

• 1. All of the above

Answer explanation

1. Unlike assessments, audits are always performed by an independent auditor who does not have a vested interest in the outcome. Audits may be performed at the request of internal management, a board of directors, or regulatory authorities.

Which element of a privacy program is likely to remain unchanged for long periods of time?

• 1. Mission

• 1. Goals

• 1. Objectives

• 1. Procedures

Answer explanation

1. The mission of a privacy program should be written at a high level as an enduring document. The goals, objectives, and procedures of a privacy program may change frequently as business needs and privacy requirements change.

Tonya is seeking to de-identify a set of records about her organization's customers. She is following the HHS guidelines for de-identifying records and is removing ZIP codes associated with small towns. What is the smallest population size for which she may retain a ZIP code?

• 1. 1,000

• 2,000

• 10,000

• 20,000

Answer explanation

1. The HHS guidelines for the de-identification of records specify that ZIP codes should be included only if the region represented by the ZIP code has 20,000 or more residents.