IAPP CIPP-C Exam Dumps

IAPP CIPP-C Sample Question Answers

IAPP CIPP-C Sample Questions

Question # 1

According to the Voluntary Code of Conduct on the Responsible Development andManagement of Advanced Generative AI Systems, signatories commit to doing all of thefollowing EXCEPT?

A. Contributing to the development and application of Al standards.  
B. Sharing information and best practices of Al governance.  
C. Supporting public awareness and education on Al.  
D. Adopting low-risk uses of AI.  

Answer: D

Show Answer

Question # 2

According to the federal Privacy Act, before collecting personal information, public-sectororganizations are required to ensure that any of the following are met EXCEPT?

A. Collection directly relates to, and is necessary for, operating a program of thatorganization. 
B. Collection is for the purposes of a law enforcement action.  
C. Collection is expressly authorized under an act.  
D. Collection is authorized by consent.  

Answer: D

Show Answer

Question # 3

A federally regulated company based in Ontario has customers in Ontario, Quebec, NewBrunswick, Alberta and British Columbia. Unfortunately, a third-party vendor that providesmarketing support to the company experiences a privacy breach which impacts thepersonal information of all its customers across the provinces where it operates.The Privacy Officer determines that the breach causes a real risk of significant harm totheir customers and is tasked with reporting the breach to the relevant regulators.With which provincial privacy regulators does the company have to file a report?

A. It is unnecessary to file a report with any provinces because the company is federallyregulated 
B. All of the provinces where its customers are located  
C. New Brunswick and British Columbia only  
D. Quebec and Alberta only  

Answer: B

Show Answer

Question # 4

According to the federal Privacy Commissioner, what protection is missing from the PrivacyAct regarding outsourcing of government work that contains personal information?

A. A statement preventing the vendor to whom the information is outsourced to subcontractits processing. 
B. A statement granting the Privacy Commissioner the right to issue orders following aninvestigation into a possible data breach.  
C. A statement requiring the government agency to complete a Privacy Impact Assessment(PIA) prior to outsourcing to a third party. 
D. A statement indicating that the government institution from which the information isoutsourced remains accountable for its security. 

Answer: D

Show Answer

Question # 5

Under PIPEDA, each of the following are considered to be personal information EXCEPT? 

A. A public official's salary published on a government web site.  
B. A person's telephone number published in a public directory.  
C. A photograph taken in public and published in a newspaper.  
D. Information about a defendant contained in court records.  

Answer: A

Show Answer

Question # 6

Oversight authorities allow the following types of consent EXCEPT? 

A. Implied consent at the time of collection.  
B. Verbal consent given to the person collecting the information.  
C. Written consent included with the information that is collected.  
D. General consent covering all activities associated with the personal information.  

Answer: D

Show Answer

Question # 7

According to the Privacy Act, which of the following disclosures of personal information bya government institution would require the data subject’s consent?

A. When disclosing to a law enforcement body.  
B. When disclosing to comply with a search warrant.  
C. When disclosing to a registered charitable organization.  
D. When disclosing to a member of parliament to assist in resolving a problem.  

Answer: C

Show Answer

Question # 8

ABC Corp uses a third-party provider to perform data analytics and sends the followingdata sets to the third party to run some reports: name, customer ID, age, transactionactivity, transaction date, location, outcome, customer type.If ABC Corp wants the third party to send all the data sets to their US based marketingpartner for a new use, they must?

A. Encrypt data in transit.  
B. Anonymize the personal data before sending.  
C. Seek additional consent from their customers.  
D. Ensure the marketing partner has equal or stronger protections than Canada.  

Answer: C

Show Answer

Question # 9

A small commercial business in Canada was preparing a mailing to its customers when theletters and the envelopes were mismatched, causing 500 of 1000 letters to be sent to thewrong recipients. The letters contained the name and mailing address of the clients as wellas account numbers and account balances.The business has discovered this error as clients called to report receiving the wrong letterand expressing concern that their information has been breached. Which of the following isthe most appropriate next step to take?

A. All 1000 clients must be sent new letters.  
B. The 500 clients who were impacted must be immediately notified.  
C. The Office of the Privacy Commissioner (OPC) must be immediately notified.  
D. A risk assessment must be completed to determine the real risk of significant harm(RROSH) to the clients. 

Answer: D

Show Answer

Question # 10

Which question is NOT part of the Office of the Privacy Commissioner of Canada’s (OPC’s)four-point test for establishing whether providing access to genetic testing results goesbeyond what is necessary or reasonable?

A. Are there less privacy-invasive alternatives?  
B. Are the collection and the use proportionate to the benefits gained?  
C. Are the validity and accuracy of individual test results guaranteed to be accurate?  
D. Is the personal information likely to be effective in achieving a legitimate businesspurpose?  

Answer: C

Show Answer

Question # 11

What is required of a private sector organization that is subject to a finding by a Canadianfederal or 

A. In Québec, comply with the finding as a binding decision.  
B. Comply with findings of the Privacy Commissioner of Canada only.  
C. In all jurisdictions, adopt and apply the finding within 30 days of the published report.  
D. In Ontario only, apply for judicial review within a provincial court in order to accept orrefute the finding. 

Answer: A

Show Answer

Question # 12

Which of the following incidents will require reporting to OPC? 

A. A sales report with aggregated information that was sent to the wrong person internally.  
B. A file with client ID, sales amount and sales date that was sent to the wrong processorswho cannot identify the clients. 
C. An organization’s point-of-sale system that was subject to an attempted hack that wasblocked by the organization’s firewall. 
D. As part of a freedom of information request, a nursing home that released an e-mail witheverybody’s e-mail address in the "to" section unredacted. 

Answer: D

Show Answer

Question # 13

According to the Canadian Standards Association (CSA) Model Code, how long shouldpersonal information be retained?

A. Personal information should not be retained at all.  
B. Personal information should be retained indefinitely as long as consent has been given.  
C. Personal information should be retained for at least two years after the lastadministrative use. 
D. Personal information should be retained as long as necessary for the fulfillment of thepurpose of the collection. 

Answer: D

Show Answer

Question # 14

In 2007, four employees of TELUS Communications Corporation filed a complaint with thePrivacy Commissioner of Canada in connection with the collection of what personalinformation?

A. Voiceprint information.  
B. Drivers' licenses.  
C. Urine samples.  
D. Video images.  

Answer: C

Show Answer

Question # 15

In Ontario, personal information can be withheld from disclosure in a Freedom ofInformation (FOI) request. The following information is included in a record that is thesubject of a FOI request being handled by a hospital: employee name, employee title,employee designation, employee educational history, employee personal cell phonenumber, and feedback about the employee from a colleague.Which of the following statements is accurate regarding what can be released?

A. Employee name and title can only be released if the employee consents  
B. The employee designation is not to be released as it is considered employment history.  
C. Employee name, title, and designation can be released as it is not classified as personalinformation. 
D. No employee information can be released as it is information that was collectedthroughout the course of employment. 

Answer: C

Show Answer