Grab latest IAPP CIPP-US Dumps as PDF Updated on 2026

Newly Released CIPP-US Dumps for Certified Information Privacy Professional Certified

The IAPP CIPP-US exam is a measure of how well a specialist is conversant with data protection laws in the US. The associated certification called the CIPP-US stands for the Certified Information Privacy Professional-US. It has accreditation from ANSI/ISO and is continually updated to ensure that the candidate only gets tested for the most current concepts in the industry. The questions in the official exam assess varying areas of the US data protection policies and a candidate needs to know how to apply and manage them in their daily work.

Prerequisites

Commonly, candidates do not have specific conditions to meet before they sit for the CIPP-US exam. However, one needs to have a basic understanding of data protection policies and concepts in the country. If a candidate does not have prior experience in the industry that will have exposed them to the concepts and skills tested, they should study the Body of Knowledge for this certificate, the certification handbook, as well as the exam outline.

 

NEW QUESTION # 36
What was the original purpose of the Federal Trade Commission Act?

• A. To enforce antitrust laws
• B. To protect consumers
• C. To negotiate consent decrees with companies violating personal privacy
• D. To ensure privacy rights of U.S. citizens

Answer: A

Explanation:
The Federal Trade Commission Act (FTCA) was adopted in 1914 as part of the Progressive Era reforms that aimed to curb the power and influence of monopolies and trusts in the U.S. economy. The FTCA created the Federal Trade Commission (FTC) as an independent agency to investigate and prevent unfairmethods of competition and unfair or deceptive acts or practices in or affecting commerce. The FTCA also gave the FTC the authority to issue cease and desist orders, seek injunctions, and impose civil penalties for violations of the law. The FTCA was intended to complement and supplement the existing antitrust laws, such as the Sherman Act and the Clayton Act, that prohibited restraints of trade, price-fixing, mergers, and other anticompetitive conduct.
The other options are not correct, because:
* The FTCA did not explicitly address privacy rights of U.S. citizens, although the FTC later used its authority under the FTCA to enforce against unfair or deceptive privacy practices, such as making false or misleading claims, failing to disclose material information, or violating consumers' choices or expectations regarding their personal data.
* The FTCA did not specifically focus on consumer protection, although the FTC later expanded its scope to include consumer protection issues, such as advertising and marketing, credit and finance, privacy and security, and consumer education. The FTC also enforced other consumer protection laws, such as the Truth in Lending Act, the Fair Credit Reporting Act, the Children's Online Privacy Protection Act, and the CAN-SPAM Act.
* The FTCA did not authorize the FTC to negotiate consent decrees with companies violating personal privacy, although the FTC later used consent decrees as a common tool to settle privacy cases and impose remedial measures, such as audits, reports, and compliance programs. Consent decrees are agreements between the FTC and the parties involved in a case that resolve the FTC's charges without admitting liability or wrongdoing.
References:
* FTC website, Federal Trade Commission Act
* Britannica website, Federal Trade Commission Act (FTCA)
* IAPP CIPP/US Study Guide, Chapter 1: Introduction to the U.S. Privacy Environment, pp. 11-12
* IAPP website, Federal Trade Commission Act, Section 5 of

NEW QUESTION # 37
SCENARIO
Please use the following to answer the next question:
Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his supervisor, Evan. Just last week, he overheard Evan mocking the state's Do Not Call list, as well as the people on it. "If they were really serious about not being bothered," Evan said, "They'd be on the national DNC list. That's the only one we're required to follow. At SunriseLynx, we call until they ask us not to." Bizarrely, Evan requires telemarketers to keep records of recipients who ask them to call "another time." This, to Larry, is a clear indication that they don't want to be called at all. Evan doesn't see it that way.
Larry believes that Evan's arrogance also affects the way he treats employees. The U.S.
Constitution protects American workers, and Larry believes that the rights of those at SunriseLynx are violated regularly. At first Evan seemed friendly, even connecting with employees on social media. However, following Evan's political posts, it became clear to Larry that employees with similar affiliations were the only ones offered promotions.
Further, Larry occasionally has packages containing personal-use items mailed to work. Several times, these have come to him already opened, even though this name was clearly marked. Larry thinks the opening of personal mail is common at SunriseLynx, and that Fourth Amendment rights are being trampled under Evan's leadership.
Larry has also been dismayed to overhear discussions about his coworker, Sadie. Telemarketing calls are regularly recorded for quality assurance, and although Sadie is always professional during business, her personal conversations sometimes contain sexual comments. This too is something Larry has heard Evan laughing about. When he mentioned this to a coworker, his concern was met with a shrug. It was the coworker's belief that employees agreed to be monitored when they signed on. Although personal devices are left alone, phone calls, emails and browsing histories are all subject to surveillance. In fact, Larry knows of one case in which an employee was fired after an undercover investigation by an outside firm turned up evidence of misconduct. Although the employee may have stolen from the company, Evan could have simply contacted the authorities when he first suspected something amiss.
Larry wants to take action, but is uncertain how to proceed.
In what area does Larry have a misconception about private-sector employee rights?

• A. The enforceability of local law
• B. The applicability of federal law
• C. The definition of tort law
• D. The strict nature of state law

Answer: B

Explanation:
Larry has a misconception about the applicability of federal law to private-sector employee rights.
He believes that the U.S. Constitution protects American workers from various forms of discrimination, harassment, and invasion of privacy by their employers. However, the U.S.
Constitution only applies to government actions, not private actions, unless there is a specific federal statute that extends constitutional protections to the private sector. For example, the Civil Rights Act of 1964 prohibits discrimination on the basis of race, color, religion, sex, or national origin by private employers. The Electronic Communications Privacy Act of 1986 regulates the interception and disclosure of electronic communications by private parties. The CAN-SPAM Act of 2003 sets the rules for commercial email and gives recipients the right to opt out of receiving unwanted messages. These are examples of federal laws that apply to private-sector employees, but they do not cover all the situations that Larry faces at SunriseLynx. For instance, there is no federal law that protects private- sector employees from political discrimination or from having their personal mail opened by their employers. Larry may have to rely on state laws or common law torts to seek redress for these violations of his rights.

NEW QUESTION # 38
A large online bookseller decides to contract with a vendor to manage Personal Information (PI). What is the least important factor for the company to consider when selecting the vendor?

• A. The vendor's financial health
• B. The vendor's reputation
• C. The vendor's employee retention rates
• D. The vendor's employee training program

Answer: C

Explanation:
When selecting a vendor to manage personal information, the company should consider various criteria, such as the vendor's reputation, financial health, employee training program, privacy policies, security practices, compliance record, contractual terms, and service quality. However, the vendor's employee retention rates may not be as important as the other factors, as they do not directly affect the vendor's ability to protect and process the personal information entrusted to them. While high employee turnover may indicate some issues with the vendor's management or culture, it may not necessarily impact the vendor's performance or reliability, as long as the vendor has adequate measures to ensure continuity, accountability, and confidentiality of the personal information they handle. References:
* Vendor Selection Process: a Step-by-Step Guide, section "Step 2: Define the vendor selection criteria"
* [IAPP CIPP/US Study Guide], p. 81-82, section 3.4.1
* [IAPP CIPP/US Body of Knowledge], p. 18-19, section C.2.a

NEW QUESTION # 39
Which of the following federal agencies does NOT have regulatory authority related to privacy?

• A. U.S. Department of Transportation.
• B. Consumer Financial Protection Bureau.
• C. U.S. Department of Commerce.
• D. Federal Reserve

Answer: A

NEW QUESTION # 40
Which action is prohibited under the Electronic Communications Privacy Act of 1986?

• A. Monitoring all employee telephone calls
• B. Intercepting electronic communications and unauthorized access to stored communications
• C. Monitoring employee telephone calls of a personal nature
• D. Accessing stored communications with the consent of the sender or recipient of the message

Answer: B

Explanation:
The Electronic Communications Privacy Act of 1986 (ECPA) is a federal law that protects the privacy of wire, oral, and electronic communications while they are being made, in transit, or stored on computers. The ECPA has three titles: Title I prohibits the intentional interception, use, or disclosure of wire, oral, or electronic communications, except for certain exceptions, such as consent, provider protection, or law enforcement purposes. Title II, also known as the Stored Communications Act (SCA), prohibits the unauthorized access to or disclosure of stored wire or electronic communications, such as email, voicemail, or online messages, except for certain exceptions, such as consent, provider protection, or law enforcement purposes. Title III regulates the installation and use of pen register and trap and trace devices, which record the numbers dialed to or from a telephone line, but not the content of the communications. Therefore, the action that is prohibited under the ECPA is intercepting electronic communications and unauthorized access to stored communications, which are covered by Title I and Title II of the Act, respectively.

NEW QUESTION # 41
In March 2012, the FTC released a privacy report that outlined three core principles for companies handling consumer dat a. Which was NOT one of these principles?

• A. Practicing Privacy by Design.
• B. Providing greater transparency.
• C. Simplifying consumer choice.
• D. Enhancing security measures.

Answer: D

NEW QUESTION # 42
Which of the following is NOT one of three broad categories of products offered by data brokers, as identified by the U.S. Federal Trade Commission (FTC)?

• A. Risk mitigation (such as information that may reduce the risk of fraud).
• B. Marketing (such as appending data to customer information that a marketing company already has).
• C. Research (such as information for understanding consumer trends).
• D. Location of individuals (such as identifying an individual from partial information).

Answer: D

NEW QUESTION # 43
Federal laws establish which of the following requirements for collecting personal information of minors under the age of 13?

• A. Implied consent from a minor's parent or guardian before collecting a minor's personal information online, such as when they permit the minor to use the internet.
• B. Implied consent from a minor's parent or guardian, or affirmative consent from the minor.
• C. Affirmative consent of a parent or guardian before collecting personal information of a minor offline (e.g., in person), which also satisfies any requirements for online consent.
• D. Affirmative consent from a minor's parent or guardian before collecting the minor's personal information online.

Answer: D

Explanation:
The Children's Online Privacy Protection Act (COPPA) is a federal law that regulates the online collection and use of personal information from children under 13 years of age. COPPA requires operators of websites or online services that are directed to children, or that knowingly collect personal information from children, to obtain verifiable parental consent before collecting, using, or disclosing such information. Verifiable parental consent means any reasonable effort (taking into consideration available technology) to ensure that before personal information is collected from a child, the child's parent receives notice of the operator's information practices and consents to those practices. COPPA also imposes other obligations on operators, such as providing parents with access to their children's information, maintaining reasonable security measures, and limiting data retention. References: COPPA, IAPP CIPP/US Study Guide, Chapter 2, Section 2.3.1

NEW QUESTION # 44
What is the main reason some supporters of the European approach to privacy are skeptical about self- regulation of privacy practices?

• A. A large amount of money may have to be sent on improved technology and security
• B. Human rights may be disregarded for the sake of privacy
• C. Industries may not be strict enough in the creation and enforcement of rules
• D. A new business owner may not understand the regulations

Answer: C

NEW QUESTION # 45
What is a key way that the Gramm-Leach-Bliley Act (GLBA) prevents unauthorized access into a person's back account?

• A. By requiring the financial institutions limit the collection of personal information.
• B. By restricting the disclosure of customer account numbers by financial institutions.
• C. By requiring the amount of customer personal information printed on paper.
• D. By requiring immediate public disclosure after a suspected security breach.

Answer: B

Explanation:
The GLBA prohibits financial institutions from disclosing a consumer's account number or similar form of access number or access code to any nonaffiliated third party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer. This restriction is intended to prevent unauthorized access to a person's bank account by third parties who may use the account number to initiate fraudulent transactions or identity theft. The GLBA also requires financial institutions to implement safeguards to protect the security, confidentiality, and integrity of customer information, and to notify customers and regulators in the event of a security breach involving such information.

NEW QUESTION # 46
SCENARIO
Please use the following to answer the next question:
A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer's data handling practices.
The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her withdrawal of consent and request for erasure of her personal data. Your organization, the US-based startup company, was never informed of this request for erasure by the EU-based retail partner. The supervisory authority investigating the complaint has threatened the suspension of data flows if the parties involved do not cooperate with the investigation. The letter closes with an urgent request: "Please act immediately by identifying all personal data received from our company." This is an important partnership. Company executives know that its biggest fans come from Western Europe; and this retailer is primarily responsible for the startup's rapid market penetration.
As the Company's data privacy leader, you are sensitive to the criticality of the relationship with the retailer.
Upon review, the data privacy leader discovers that the Company's documented data inventory is obsolete. What is the data privacy leader's next best source of information to aid the investigation?

• A. Interviews with key marketing personnel
• B. Lists of all customers, sorted by country
• C. Database schemas held by the retailer
• D. Reports on recent purchase histories

Answer: A

Explanation:
The data privacy leader needs to identify all the personal data that the Company has received from the retailer, as well as the purposes, retention periods, and sharing practices of such data.
Since the data inventory is obsolete, the data privacy leader cannot rely on it to provide accurate and complete information. Therefore, the next best source of information is to interview the key marketing personnel who are responsible for the partnership with the retailer and the use of the personal data. The marketing personnel can provide insights into the data flows, the data categories, the data processing activities, and the data protection measures that the Company has implemented. They can also help the data privacy leader to locate the relevant documents, contracts, and records that can support the investigation.

NEW QUESTION # 47
Which of the following is NOT a principle found in the APEC Privacy Framework?

• A. Privacy by Design.
• B. Preventing Harm.
• C. Access and Correction.
• D. Integrity of Personal Information.

Answer: A

Explanation:
The APEC Privacy Framework is a set of non-binding principles adopted by the Asia-Pacific Economic Cooperation (APEC) that aim to promote electronic commerce and protect information privacy in the region. The Framework is consistent with the core values of the OECD Guidelines on the Protection of Privacy and Trans-Border Flows of Personal Data, and reaffirms the value of privacy to individuals and to the information society. The Framework consists of nine principles:
Preventing Harm, Notice, Collection Limitation, Use of Personal Information, Choice, Integrity of Personal Information, Security Safeguards, Access and Correction, and Accountability. Privacy by Design is not one of the principles in the APEC Privacy Framework, although it is a concept that is endorsed by the OECD Guidelines and other privacy frameworks.

NEW QUESTION # 48
What are banks required to do under the Gramm-Leach-Bliley Act (GLBA)?

• A. Offer an Opt-Out before transferring PI to an unaffiliated third party for the latter's own use
• B. Conduct annual consumer surveys regarding satisfaction with user preferences
• C. Process requests for changes to user preferences within a designated time frame
• D. Provide consumers with the opportunity to opt out of receiving telemarketing phone calls

Answer: A

Explanation:
Explanation/Reference: https://www.investopedia.com/terms/g/glba.asp

NEW QUESTION # 49
Due to cookie deprecation, businesses will be required to simplify their tracking practices by doing what?

• A. Purging existing IDs that identify visitors by browser.
• B. Deleting their existing data sets of any third-party cookies
• C. Ensuring only registered users are tracked.
• D. Running analytics only in dedicated sandboxes

Answer: B

Explanation:
With the impending deprecation of third-party cookies, businesses must simplify their tracking practices and shift to more privacy-conscious technologies. Third-party cookies are being phased out by major web browsers, such as Google Chrome, to improve user privacy and reduce cross-site tracking.
One of the most critical actions businesses need to take is deleting existing data sets of third-party cookies, as they will soon become obsolete. This action ensures compliance with emerging privacy standards and helps organizations transition to alternative methods of tracking, such as first-party data collection or consent- based tracking mechanisms.
Explanation of Options:
* A. Ensuring only registered users are tracked:While focusing on registered users might simplify tracking, it does not address the broader privacy concerns surrounding third-party cookies.
* B. Running analytics only in dedicated sandboxes:Sandboxing analytics tools may enhance security, but it does not directly relate to the transition away from third-party cookies.
* C. Purging existing IDs that identify visitors by browser:Browser IDs are not inherently tied to third- party cookies. Purging them might be part of broader privacy compliance efforts but is not the primary issue with cookie deprecation.
* D. Deleting their existing data sets of any third-party cookies:This is correct. Deleting existing third- party cookie data is a necessary step to align with the move away from third-party cookies, ensuring businesses are prepared for the shift to new tracking technologies.
References from CIPP/US Materials:
* IAPP CIPP/US Certification Textbook: Discusses cookie deprecation and the shift towards first-party data and privacy-conscious tracking.
* California Consumer Privacy Act (CCPA): Regulates the use of cookies and other tracking technologies, emphasizing user consent and transparency.

NEW QUESTION # 50
U.S. federal laws protect individuals from employment discrimination based on all of the following EXCEPT?

• A. Pregnancy.
• B. Genetic information.
• C. Marital status.
• D. Age.

Answer: C

NEW QUESTION # 51
What is a key way that the Gramm-Leach-Bliley Act (GLBA) prevents unauthorized access into a person's back account?

• A. By requiring the financial institutions limit the collection of personal information.
• B. By restricting the disclosure of customer account numbers by financial institutions.
• C. By requiring the amount of customer personal information printed on paper.
• D. By requiring immediate public disclosure after a suspected security breach.

Answer: B

Explanation:
The GLBA prohibits financial institutions from disclosing a consumer's account number or similar form of access number or access code to any nonaffiliated third party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer. This restriction is intended to prevent unauthorized access to a person's bank account by third parties who may use the account number to initiate fraudulent transactions or identity theft. The GLBA also requires financial institutions to implement safeguards to protect the security, confidentiality, and integrity of customer information, and to notify customers and regulators in the event of a security breach involving such information. References:
* IAPP CIPP/US Certified Information Privacy Professional Study Guide, Chapter 2: Limits on Private-sector Collection and Use of Data, Section 2.3: Financial Privacy, p. 49-50
* IAPP CIPP/US Body of Knowledge, Domain II: Limits on Private-sector Collection and Use of Data, Objective II.C: Identify the privacy requirements for financial institutions, Subobjective II.C.2: Identify the restrictions on disclosure of account numbers, p. 14
* IAPP CIPP/US Exam Blueprint, Domain II: Limits on Private-sector Collection and Use of Data, Objective II.C: Identify the privacy requirements for financialinstitutions, Subobjective II.C.2: Identify the restrictions on disclosure of account numbers, p. 5

NEW QUESTION # 52
SCENARIO
Please use the following to answer the next QUESTION:
Cheryl is the sole owner of Fitness Coach, Inc., a medium-sized company that helps individuals realize their physical fitness goals through classes, individual instruction, and access to an extensive indoor gym. She has owned the company for ten years and has always been concerned about protecting customer's privacy while maintaining the highest level of service. She is proud that she has built long-lasting customer relationships.
Although Cheryl and her staff have tried to make privacy protection a priority, the company has no formal privacy policy. So Cheryl hired Janice, a privacy professional, to help her develop one.
After an initial assessment, Janice created a first of a new policy. Cheryl read through the draft and was concerned about the many changes the policy would bring throughout the company. For example, the draft policy stipulates that a customer's personal information can only be held for one year after paying for a service such as a session with personal trainer. It also promises that customer information will not be shared with third parties without the written consent of the customer. The wording of these rules worry Cheryl since stored personal information often helps her company to serve her customers, even if there are long pauses between their visits. In addition, there are some third parties that provide crucial services, such as aerobics instructors who teach classes on a contract basis. Having access to customer files and understanding the fitness levels of their students helps instructors to organize their classes.
Janice understood Cheryl's concerns and was already formulating some ideas for revision. She tried to put Cheryl at ease by pointing out that customer data can still be kept, but that it should be classified according to levels of sensitivity. However, Cheryl was skeptical. It seemed that classifying data and treating each type differently would cause undue difficulties in the company's day-to-day operations. Cheryl wants one simple data storage and access system that any employee can access if needed.
Even though the privacy policy was only a draft, she was beginning to see that changes within her company were going to be necessary. She told Janice that she would be more comfortable with implementing the new policy gradually over a period of several months, one department at a time. She was also interested in a layered approach by creating documents listing applicable parts of the new policy for each department.
What is the best reason for Cheryl to follow Janice's suggestion about classifying customer data?

• A. It will increase the security of customers' personal information (PI)
• B. It will help employees stay better organized
• C. It will help the company meet a federal mandate
• D. It will prevent the company from collecting too much personal information (PI)

Answer: A

Explanation:
Data classification systematically categorizes information based on sensitivity and importance to determine its level of confidentiality. This process helps apply appropriate security and compliance measures to ensure each category receives proper protection1. This process also helps to identify which personal data is subject to specific GDPR requirements, such as obtaining explicit consent from data subjects, or notifying data subjects in the event of a data breach2. By classifying data, Cheryl can also make more informed decisions about where to store the information on her computer system and the nature of controls that are required based on classification3. This way, she can protect her customers' privacy while maintaining the highest level of service. References:
* Data Classification for GDPR Explained
* A guide to data classification: confidential data vs. sensitive data vs. public information
* Why Is Data Classification Important?

NEW QUESTION # 53
Which of the following laws is NOT involved in the regulation of employee background checks?

• A. The Civil Rights Act.
• B. The U.S. Fair Credit Reporting Act (FCRA).
• C. The Gramm-Leach-Bliley Act (GLBA).
• D. The California Investigative Consumer Reporting Agencies Act (ICRAA).

Answer: C

Explanation:
The law that is not involved in the regulation of employee background checks is B. The Gramm-Leach-Bliley Act (GLBA). The GLBA is a federal law that regulates the privacy and security of financial information collected, used, or shared by financial institutions, such as banks, insurance companies, or securities firms. The GLBA does not apply to employee background checks, unless the employer is a financial institution that obtains financial information from a consumer reporting agency for employment purposes. In that case, the employer must comply with the GLBA's notice and opt-out requirements, as well as the FCRA's requirements for using consumer reports. References:
* [IAPP CIPP/US Study Guide], Chapter 4: Workplace Privacy, pp. 113-114.
* IAPP CIPP/US Body of Knowledge, Section IV: Workplace Privacy, Subsection A: Employee Privacy Expectations, Topic 3: Background Checks.
* IAPP CIPP/US Practice Questions, Question 150.

NEW QUESTION # 54
Which of the following accurately describes the purpose of a particular federal enforcement agency?

• A. The Federal Trade Commission (FTC) is typically recognized as having the broadest authority under the FTC Act to address unfair or deceptive privacy practices.
• B. The Federal Communications Commission (FCC) regulates privacy practices on the internet and enforces violations relating to websites' posted privacy disclosures.
• C. The Cybersecurity and Infrastructure Security Agency (CISA) is authorized to bring civil enforcement actions against organizations whose website or other online service fails to adequately secure personal information.
• D. The National Institute of Standards and Technology (NIST) has established mandatory privacy standards that can then be enforced against all for-profit organizations by the Department of Justice (DOJ).

Answer: A

Explanation:
The FTC is the primary federal agency responsible for enforcing privacy and data security laws in the United States. The FTC has broad jurisdiction over most commercial entities that collect, use, or share personal information from consumers. The FTC Act prohibits unfair or deceptive acts or practices in or affecting commerce, which includes unfair or deceptive privacy practices. The FTC can bring enforcement actions against companies that violate their own privacy policies, fail to provide adequate notice or choice to consumers, engage in unfair or harmful data practices, or breach consumers' reasonable expectations of privacy. The FTC can also issue rules, guidelines, and reports on privacy and data security issues, as well as conduct investigations, workshops, and educational campaigns.

NEW QUESTION # 55
Based on the 2012 Federal Trade Commission report "Protecting Consumer Privacy in an Era of Rapid Change", which of the following directives is most important for businesses?

• A. Allowing consumers to opt in before collecting any data.
• B. Integrating privacy protections during product development.
• C. Announcing the tracking of online behavior for advertising purposes.
• D. Mitigating harm to consumers after a security breach.

Answer: B

Explanation:
https://www.ftc.gov/sites/default/files/documents/reports/federal-trade-commission-report-protecting-consumer-privacy-era-rapid-change-recommendations/120326privacyreport.pdf

NEW QUESTION # 56
Which federal agency plays a role in privacy policy, but does NOT have regulatory authority?

• A. The Office of the Comptroller of the Currency.
• B. The Federal Communications Commission.
• C. The Department of Commerce.
• D. The Department of Transportation.

Answer: C

Explanation:
The Department of Commerce (DOC) plays a role in privacy policy by promoting the development and adoption of voluntary codes of conduct, standards, and best practices for the private sector, as well as facilitating cross-border data transfers through mechanisms such as the EU-U.S.
Privacy Shield and the APEC Cross-Border Privacy Rules. However, the DOC does not have regulatory authority to enforce privacy laws or impose sanctions for privacy violations. The other agencies listed have some degree of regulatory authority over privacy issues within their respective domains. For example, the Office of the Comptroller of the Currency (OCC) supervises national banks and federal savings associations and enforces the GLBA privacy and security rules for these institutions. The Federal Communications Commission (FCC) regulates interstate and international communications and enforces the privacy and security rules for telecommunications carriers, broadband providers, and voice over internet protocol (VoIP) services. The Department of Transportation (DOT) oversees the transportation sector and enforces the privacy and security rules for airlines, travel agents, and other covered entities under the Aviation and Transportation Security Act (ATSA).

NEW QUESTION # 57
SCENARIO
Please use the following to answer the next question:
Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his supervisor, Evan. Just last week, he overheard Evan mocking the state's Do Not Call list, as well as the people on it. "If they were really serious about not being bothered," Evan said, "They'd be on the national DNC list. That's the only one we're required to follow. At SunriseLynx, we call until they ask us not to." Bizarrely, Evan requires telemarketers to keep records of recipients who ask them to call "another time." This, to Larry, is a clear indication that they don't want to be called at all. Evan doesn't see it that way.
Larry believes that Evan's arrogance also affects the way he treats employees. The U.S.
Constitution protects American workers, and Larry believes that the rights of those at SunriseLynx are violated regularly. At first Evan seemed friendly, even connecting with employees on social media. However, following Evan's political posts, it became clear to Larry that employees with similar affiliations were the only ones offered promotions.
Further, Larry occasionally has packages containing personal-use items mailed to work. Several times, these have come to him already opened, even though this name was clearly marked. Larry thinks the opening of personal mail is common at SunriseLynx, and that Fourth Amendment rights are being trampled under Evan's leadership.
Larry has also been dismayed to overhear discussions about his coworker, Sadie. Telemarketing calls are regularly recorded for quality assurance, and although Sadie is always professional during business, her personal conversations sometimes contain sexual comments. This too is something Larry has heard Evan laughing about. When he mentioned this to a coworker, his concern was met with a shrug. It was the coworker's belief that employees agreed to be monitored when they signed on. Although personal devices are left alone, phone calls, emails and browsing histories are all subject to surveillance. In fact, Larry knows of one case in which an employee was fired after an undercover investigation by an outside firm turned up evidence of misconduct. Although the employee may have stolen from the company, Evan could have simply contacted the authorities when he first suspected something amiss.
Larry wants to take action, but is uncertain how to proceed.
Which act would authorize Evan's undercover investigation?

• A. The Whistleblower Protection Act
• B. The Fair and Accurate Credit Transactions Act (FACTA)
• C. The National Labor Relations Act (NLRA)
• D. The Stored Communications Act (SCA)

Answer: D

Explanation:
The Stored Communications Act (SCA) is a federal law that regulates the privacy of electronic communications that are stored by third-party service providers, such as email providers, cloud storage providers, or social media platforms. The SCA prohibits unauthorized access to or disclosure of such communications, unless authorized by law or by the consent of the user or the service provider . The SCA also provides exceptions for certain types of access or disclosure, such as those made for law enforcement purposes, for the protection of the service provider's rights or property, or for the consent of the subscriber or customer .
One of the exceptions to the SCA is where the service provider gives consent to the access or disclosure of the stored communications. This means that if a third-party service provider agrees to cooperate with an investigation or a request for information, the access or disclosure is lawful under the SCA. Consent can be express or implied, depending on the circumstances and the terms of service of the provider. For example, if a service provider has a policy that allows it to disclose user information to third parties for legitimate purposes, the provider has impliedly consented to the access or disclosure of the stored communications. However, if a service provider has a policy that prohibits such disclosure, the provider has not consented to the access or disclosure of the stored communications.
In the scenario, Evan's undercover investigation may have been authorized by the SCA if he obtained the consent of the third-party service provider that stored the electronic communications of the employee who was suspected of misconduct. For instance, if the employee used a company email account or a cloud storage service that had a policy that allowed the service provider to disclose user information to the employer or to law enforcement, Evan may have been able to access or disclose the stored communications with the consent of the service provider.
However, if the employee used a personal email account or a cloud storage service that had a policy that protected user privacy and prohibited such disclosure, Evan may have violated the SCA by accessing or disclosing the stored communications without the consent of the service provider.

NEW QUESTION # 58
SCENARIO
Please use the following to answer the next QUESTION:
Matt went into his son's bedroom one evening and found him stretched out on his bed typing on his laptop. "Doing your network?" Matt asked hopefully.
"No," the boy said. "I'm filling out a survey."
Matt looked over his son's shoulder at his computer screen. "What kind of survey?" "It's asking Questions about my opinions."
"Let me see," Matt said, and began reading the list of Questions that his son had already answered. "It's asking your opinions about the government and citizenship. That's a little odd. You're only ten." Matt wondered how the web link to the survey had ended up in his son's email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders.
To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer Questions about his favorite games and toys.
Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son's inbox, and he decided it was time to report the incident to the proper authorities.
How could the marketer have best changed its privacy management program to meet COPPA "Safe Harbor" requirements?

• A. By receiving FTC approval for the content of its emails
• B. By making a COPPA privacy notice available on website
• C. By regularly assessing the security risks to consumer privacy
• D. By participating in an approved self-regulatory program

Answer: A

NEW QUESTION # 59
......

IAPP CIPP-US Certification Exam is a credential offered by the International Association of Privacy Professionals (IAPP) for professionals who work with the privacy laws and regulations in the United States. CIPP-US exam is designed to test the knowledge and skills required to navigate the complex and evolving landscape of U.S. privacy laws and regulations.

 

Latest CIPP-US Exam Dumps IAPP Exam from Training: https://passguide.vce4dumps.com/CIPP-US-latest-dumps.html