Free IAPP CIPT Exam Dumps Questions & Answers

An organization is launching a smart watch which, in addition to alerts, will notify the the wearer of incoming calls allowing them to answer on the device. This convenience also comes with privacy concerns and is an example of?

• A.  Anthropomorphism.
• B.  Ubiquitous computing.
• C.  Value-Sensitive Design.
• D.  Coupling

Organizations understand there are aggregation risks associated with the way the process their customer's data. They typically include the details of this aggregation risk in a privacy notice and ask that all customers acknowledge they understand these risks and consent to the processing.
What type of risk response does this notice and consent represent?

• A.  Risk acceptance.
• B.  Risk transfer.
• C.  Risk avoidance.
• D.  Risk mitigation.

An organization based in California, USA is implementing a new online helpdesk solution for recording customer call information. The organization considers the capture of personal data on the online helpdesk solution to be in the interest of the company in best servicing customer calls.
Before implementation, a privacy technologist should conduct which of the following?

• A.  A Legitimate Interest Assessment (LIA) to ensure that the processing is proportionate and does not override the privacy, rights and freedoms of the customers.
• B.  A privacy risk and impact assessment to evaluate potential risks from the proposed processing operations.
• C.  A security assessment of the help desk solution and provider to assess if the technology was developed with a security by design approach.
• D.  A Data Protection Impact Assessment (DPIA) and consultation with the appropriate regulator to ensure legal compliance.

SCENARIO
Please use the following to answer the next question:
Light Blue Health (LBH) is a healthcare technology company developing a new web and mobile application that collects personal health information from electronic patient health records. The application will use machine learning to recommend potential medical treatments and medications based on information collected from anonymized electronic health records. Patient users may also share health data collected from other mobile apps with the LBH app.
The application requires consent from the patient before importing electronic health records into the application and sharing it with their authorized physicians or healthcare provider. The patient can then review and share the recommended treatments with their physicians securely through the app. The patient user may also share location data and upload photos in the app. The patient user may also share location data and upload photos in the app for a healthcare provider to review along with the health record. The patient may also delegate access to the app.
LBH's privacy team meets with the Application development and Security teams, as well as key business stakeholders on a periodic basis. LBH also implements Privacy by Design (PbD) into the application development process.
The Privacy Team is conducting a Privacy Impact Assessment (PIA) to evaluate privacy risks during development of the application. The team must assess whether the application is collecting descriptive, demographic or any other user related data from the electronic health records that are not needed for the purposes of the application. The team is also reviewing whether the application may collect additional personal data for purposes for which the user did not provide consent.
What is the best way to ensure that the application only collects personal data that is needed to fulfill its primary purpose of providing potential medical and healthcare recommendations?

• A.  Disclose what personal data the application the collecting in the company Privacy Policy posted online.
• B.  Document each personal category collected by the app and ensure it maps to an app function or feature.
• C.  Provide the user with an option to select which personal data the application may collect.
• D.  Obtain consent before using personal health information for data analytics purposes.

After committing to a Privacy by Design program, which activity should take place first?

• A.  Create a privacy standard that applies to all projects and services.
• B.  Implement easy to use privacy settings for users.
• C.  Establish a retention policy for all data being collected.
• D.  Perform privacy reviews on new projects.