CIPM Exam Questions & Answers

SCENARIO

Please use the following to answer the next question:

Manasa is a product manager at Omnipresent Omnimedia, where she is responsible for leading the

development of the company's flagship product, the Handy Helper. The Handy Helper is an application

that can be used in the home to manage family calendars, do online shopping, and schedule doctor

appointments. After having had a successful launch in the United States, the Handy Helper is about to be

made available for purchase worldwide. The packaging and user guide for the Handy Helper indicate that

it is a "privacy friendly" product suitable for the whole family, including children, but does not provide any

further detail or privacy notice. In order to use the application, a family creates a single account, and the

primary user has access to all information about the other users. Upon start up, the primary user must

check a box consenting to receive marketing emails from Omnipresent Omnimedia and selected marketing

partners in order to be able to use the application.

Sanjay, the head of privacy at Omnipresent Omnimedia, was working on an agreement with a European

distributor of Handy Helper when he fielded many questions about the product from the distributor. Sanjay

needed to look more closely at the product in order to be able to answer the questions as he was not

involved in the product development process.

In speaking with the product team, he learned that the Handy Helper collected and stored all of a user's

sensitive medical information for the medical appointment scheduler. In fact, all of the user's information is

stored by Handy Helper for the additional purpose of creating additional products and to analyze usage of

the product. This data is all stored in the cloud and is encrypted both during transmission and at rest.

Consistent with the CEO's philosophy that great new product ideas can come from anyone, all

Omnipresent Omnimedia employees have access to user data under a program called Eureka.

Omnipresent Omnimedia is hoping that at some point in the future, the data will reveal insights that could

be used to create a fully automated application that runs on artificial intelligence, but as of yet, Eureka is

not well-defined and is considered a long-term goal.

What element of the Privacy by Design (PbD) framework might the Handy Helper violate?

A. Failure to obtain opt-in consent to marketing.

B. Failure to observe data localization requirements.

C. Failure to implement the least privilege access standard.

D. Failure to integrate privacy throughout the system development life cycle.

Which is NOT an influence on the privacy environment external to an organization?

A. Management team priorities.

B. Regulations.

C. Consumer demand.

D. Technological advances.

SCENARIO

Please use the following to answer the next question:

Paul Daniels, with years of experience as a CEO, is worried about his son Carlton's successful venture, Gadgo. A technological innovator in the communication industry that quickly became profitable, Gadgo has moved beyond its startup phase. While it has retained its vibrant energy, Paul fears that under Carlton's direction, the company may not be taking its risks or obligations as seriously as it needs to. Paul has hired you, a Privacy Consultant, to assess the company and report to both father and son. "Carlton won't listen to me," Paul says, "but he may pay attention to an expert."

Gadgo's workplace is a clubhouse for innovation, with games, toys, snacks. espresso machines, giant fish tanks and even an iguana who regards you with little interest. Carlton, too, seems bored as he describes to you the company's procedures and technologies for data protection. It's a loose assemblage of controls, lacking consistency and with plenty of weaknesses. "This is a technology company," Carlton says. "We create. We innovate. I don't want unnecessary measures that will only slow people down and clutter their thoughts."

The meeting lasts until early evening. Upon leaving, you walk through the office it looks as if a strong windstorm has recently blown through, with papers scattered across desks and tables and even the floor. A "cleaning crew" of one teenager is emptying the trash bins. A few computers have been left on for the night, others are missing. Carlton takes note of your attention to this: "Most of my people take their laptops home with them, or use their own tablets or phones. I want them to use whatever helps them to think and be ready day or night for that great insight. It may only come once!"

What would be the best kind of audit to recommend for Gadgo?

A. A supplier audit.

B. An internal audit.

C. A third-party audit.

D. A self-certification.