Which of the following is not one of the nine principles of the APEC framework?

Marcia is the privacy program manager at a large company. She implemented a new privacy program one year ago and now, a year in, she is concerned that the program is not going well because not all employees have completed the required training. Marcia attends a meeting of company executives to ask for more funding for the program to support the training program. The CFO objects, reasoning that the privacy program is going just fine because the company did well on its last audit. The CEO isn’t sure, so she sends Marcia back to develop a report on how many privacy-related customer complaints they’ve had before she decides to allocate new funding. What most likely went wrong here?

Marcia is the privacy program manager at a large company. She implemented a new privacy program one year ago and now, a year in, she is concerned that the program is not going well because not all employees have completed the required training. Marcia attends a meeting of company executives to ask for more funding for the program to support the training program. The CFO objects, reasoning that the privacy program is going just fine because the company did well on its last audit. The CEO isn’t sure, so she sends Marcia back to develop a report on how many privacy-related customer complaints they’ve had before she decides to allocate new funding. A week later, Marcia returns with the report that the CEO requested, but the CFO still isn’t convinced that training is worth the cost. “I know not everyone has been through the training,” reasons the CFO, “but adding more training programs is prohibitively expensive. I just don’t think it’s worth it.” What metric might Marcia use to address the CFO’s concern?

Geoff is helping a small data analytics startup company based in the United States expand their business by offering analytics services for companies in the EU. Which of the following routes is Geoff most likely to recommend to allow data transfers from EU companies to the startup?

When defining a privacy program framework, it is important to map out how information moves around internally so that data can be tracked. Which term best describes this activity?

Aidan is a new privacy manager struggling to implement a privacy program at a beloved small-town retail shop called Middleburg Threads. Aidan has implemented an initial privacy program framework and completed the initial risk assessment. He found that privacy policies weren’t written down anywhere, the computers in the back office aren’t password protected, and perhaps most concerning of all, the company has outsourced online sales, including credit card processing, to another small local business. There doesn’t seem to be any sort of formal contract in place. Which of the following might be the best place for Aidan to start?

Annie is a CEO at a rapidly growing company. Currently, the company only does business in the United States, but Annie dreams of expanding across North America. Annie also wants customer privacy to be the hallmark of her company’s reputation, so she wants to do more to protect privacy than the minimum required for compliance. Annie is considering privacy program frameworks, and she is trying to choose between adopting a FIPPs-based approach and a PbD approach. How would you advise Annie and why?

Ahmad had just been hired to run the information privacy program at Accounting Unlimited, a large corporate bookkeeping and accounting firm. Ahmad starts by assessing the current privacy program. He is pleased to note that Accounting Unlimited employs robust privacy practices. Employees follow good processes and maintain privacy controls in most (but not all) areas. However, when he asks for the documentation on all the privacy procedures, he gets a patchwork of documents from different departments. Some of the documents are out of date and some are missing. How might Ahmad classify this privacy program’s maturity level?

Jorge has finished implementing a NIST-based privacy framework for his employer. The executive team at Jorge’s company realize they cannot focus on every single activity in the large privacy program, so they want to pick out a few important privacy activities to monitor closely and improve. Which part of the NIST framework might help with this?

Melinda is an experienced pediatrician, and she has finally taken the leap to open her own clinic. She prides herself on her commitment to focusing only on her patients, so she wants to outsource some of her administrative functions, such as billing and scheduling. What does Melinda need to include in the contract when she hires a vendor for these functions?

Pierre is working on implementing a privacy program based on the NIST privacy framework. He is concerned with making sure that the program includes robust identity management. On which function of the NIST framework should Pierre focus?

Eduardo is a privacy program manager for Surfside Rentals, a small chain of stores in California that rent out surfing equipment. While Surfside Rentals has been in business for years, the company has recently decided to start offering a credit card program. Customers who sign up for the new credit card earn “juice points” that count toward free rentals for every dollar spent. Eduardo carefully monitors for any changes in privacy compliance requirements for the company. Given Surfside Rental’s recent business moves, which new type of jurisdictional category should Eduardo worry about?

Dimitri cashed a paycheck at County Bank three months ago, but he doesn’t have an account there and hasn’t been back since. Under GLBA, County Bank should consider Dimitri as which of the following?

Jennifer is an IT manager and has spent the last five years implementing privacy controls on IT systems that she hopes will reduce privacy incidents over time. Which type of metric will be most helpful to Jennifer?

Which of the following would be the least useful as a privacy program metric?

BlindDateDublin.com, an Irish dating website, was found responsible for repeatedly and purposely violating multiple provisions of the GDPR. The resulting privacy violations caused some people in the EU to lose their jobs and exposed others to social stigmas and other harms. What is the largest penalty BlindDateDublin.com might face?

Which of the following is not a benefit of performing privacy impact assessments?

Nadya runs a small local bakery in Trenton, New Jersey. Her peanut butter cookies are so popular that she has received hundreds of requests to ship boxes of her cookies nationwide. Since Nadya does not have time to run her bakery and an online ordering process, she plans to contract with eSales, Inc., to manage a website, online orders, payments, and shipping. Nadya values the trust and loyalty of her customers and wants to be sure their privacy is protected. She has looked into eSales, Inc.’s privacy notices and asked them about their privacy practices in detail. From all she can tell, Nadya is satisfied with eSales, Inc.’s commitment to privacy, but she knows that eSales is growing rapidly and might be spreading itself pretty thin. What else could Nadya do to protect the privacy of her online customers?

BizCorp has defined GLBA audit performance as a privacy program metric. Which of the following is most likely a secondary audience for this metric?