IAPP CIPM – IAPP exam questions analysed: CIPP/E, CIPM, CIPT Part 2

6. CIPM scenarios – part 3

Hi guys. Here we are at the last lesson of CIPM case studies, and we’ll finish it again with a scenario that will be bigger. Assume the amount of text is spread across three slides. So you also have all the presentations attached as a resource to all these lessons. So take the presentation and put it back. In a word, take a reading of the full scenario, and then, with you in front, take a look at all the questions and try to answer them. So, while this is a large scenario, it is something you may encounter, and you should be prepared to read it quickly and search for relevant information or evidence to answer the questions quickly. So this is the scenario in three parts, and you will have six questions related to it. So let’s start with the first one: whose responsibility was it to notify the jewellery store customers that their data had been stolen? So pause the video, try to have the scenario in front of you, try to answer the question, and come back for the answer.

The correct answer is that for jewellery store owners in the private sector, liability clauses in contracts with data processors are paramount. In the European Union, the default is well established that the data controller retains legal liability for any harm associated with the collected data. This default responsibility is only slightly less clear in the United States. in the US. And in some other jurisdictions, it is perfectly possible to make the processor liable for the remediation costs of events caused by their negligence if it is clearly stated in the contract. Let’s go on with the next question. All of the following would protect the dual owners from future employee misuse of customer data. Except, again, take a careful look at the word “accept.”

So take the scenario in front of you, read all the answers over here, pause a video, and come back. In this case, the correct answer is to be unkind to wealth management customers by not sharing customer data with them. Every organisation is held accountable for what it says it will do and not do with personal information. As such, it is the jewellery store’s responsibility, not wealth management, to provide notice as to how the jeweler’s customer data will be used. A privacy policy is generally an internal document that is addressed to employees and clearly states how personal information is going to be handled. These documents serve as a vehicle for training staff and providing assurance that all employees understand the responsibility for personal information protection.

And these policies must be clearly communicated to employees so that information is not inadvertently used for unauthorised purposes. A notice is typically an external communication of the privacy policies to customers regarding how their personal data is handled. Notices are particularly important because this is one means used by your organisation to ingrain organisational accountability externally. Typically, notices are posted on the organization’s website.

Technical controls, such as implementing systems that support role-based access, also support the larger purposes of the privacy programme by specifically identifying and limiting who can access personal information in a particular database. Let’s move on to the third question: What was the jewellery store’s first responsibility when the breach was made? No. Take a look at the word first. This is important. It is a keyword. Go back to a scenario. Try to read all the answers here, pause the video, and come back. The correct one is C. Determine whether notification is legally required. It’s important to remember that not all breaches require notification. There are various types of notification requirements for regulators and affected individuals. Once it is concluded that an actual compromise of sensitive information has occurred, the pre-notification process is triggered.

The steps taken may vary depending on several factors, but the purpose is to confirm that the event does indeed constitute a reportable breach. With so many variables influencing the notify or don’t notify decision, advice from an experienced privacy or breach attorney can prove invaluable in meeting legal obligations and mitigating unnecessary costs. Let’s move on to the following question: After the data breach, what data can the wealth management company use legally? Again, take a look at the scenario. Read all the questions, try to think, and answer them yourself. The correct answer is B. Only the purchase data Though Matilda is an employee of the company, which is the data controller, it is unlikely that she would have the authority to disclose the jewellery store’s customer data merely because she is the most computer-savvy employee and has access to this information. As such, she would not be legally authorised to share this information with the wealth management firm. In turn, this means that a wealth management firm does not have the authority to use the store’s customer data. Employee error or negligence is one of the biggest causes of privacy breaches. Matilda’s decision to disclose personal information to wealth management constitutes a breach, and therefore wealth management has no legal right to keep this data. And let’s go ahead with the following question: What would be the best? Again, take a look at the best word. The best way for the wealth management firm to respond to its customers’ complaints Take a look at the answers. Pause the video right now. The correct one is C. Establish a formal complaint and resolution procedure for managing privacy questions that may arise. It makes sense to leverage the privacy governance structure that you have instituted at a geographic and functional level to serve as the first level of response for commonly asked questions respecting privacy and security. However, handling complaints requires more formality than just responding to questions and inquiries.

There needs to be a centralised intake process through which complaints are routed to the privacy team as quickly as possible. And now we come to the final question for this scenario: who has the dual first responsibility for managing this incident? Again, we are looking for key words like “first.” So, first, responsibility. Take a look at the answers, pause the video, and come back. The answer is b. minimising the harm caused by data loss to customers. The fundamental principle that should govern a privacy incident is to allow an affected person the opportunity to protect themselves from identity theft or other harm. This harm can manifest itself not only through identity theft, but also through financial loss, reputational damage, or embarrassment, so preventing and/or mitigating the harm should be the primary focus when managing a privacy incident. In the following three instances, we’ll start the discussion about CIPT, the technology part of the use case.

7. CIPT scenarios – part 1

Hi guys. In this lesson, we’ll start looking at use cases for CIPT. So the first one is: which of these may pose a client-side privacy risk? Take a look at all these answers and try to pause the video. Think about your correct answer or your final answer, and then come back to see the result. The correct answer is a. An employee loads personal data on a company laptop. The client side represents the computers typically used by company employees. These computers normally connect to the company’s server-side systems via wireless and hardwired networks. The client side can represent a significant threat to the company’s system, as well as sensitive data that may be on the client computers. Employees often download customer files, corporate emails, and legal documents to their computers for processing. Employees may even store their personal information on company computers. Even more concerning is that the client computer can access resources across the company that could have vast amounts of planning documents that might be of great interest to competitors or corporate spies. Let’s follow up with question number two:

What can help protect against data thieves who use a network sniffer? Again, pause the video, take a look at the answers, and choose the final one. The correct answer is C. Encryption at the Transport Layer Data tips don’t need to have legitimate access to a company’s network in order to access data flowing across it. Using a network sniffer, anyone can view or copy unprotected data from a company’s wireless network. A legitimate visitor to a company could also connect a device to a network outlet using a cable and copy all unencrypted data from the network. This becomes especially important when discussing voice-over Internet Protocol technologies, where voice communications are travelling across the data network. Using strong encryption on wireless and wired networks at the transportation layer will help mitigate this threat. Let us now move on to question three: “How is the cryptographic toolkit from the United States?” National Institute of Standards and Technology useful to organizations. Take a look at the answer; stop the video right now. now and come back to see if you’re right or wrong. The correct answer in this case is B. It can help to determine an appropriate type of encryption for a particular need. Encryption is one of the best ways to protect data during transmission and storage. The type of encryption used should be based on how the encryption’s performance and complexity may impact company systems. The National Institute of Standards and Technology has developed a cryptographic toolkit to assist organisations with the selection of cryptographic security components and functionality for protecting their data communications and operations. As a follow-up to question four, an administrator wants to limit access to a data set to employees working in a certain location.

Which of the following would he use? Stop the video. If you are familiar with the CISSP questions, you will most likely find this one there as well. All these access control mechanisms are encountered in the CISSP, so choose the one that you think suits better. This question has the correct answer: Attribute-based access control, or A. ABAC is an extension of role-based access controls in that it permits the addition of attributes to refine an entity’s description. For example, an attribute can indicate the time, location, nationality, or age required to access a resource. The Extensible Access Control Markup Language is a standard that can be used to implement ABAC systems, and the last question is: “Five, what privacy practise would be most useful to users who are not knowledgeable about protecting their personal information?” Examine the most important keyword once more and try to find the correct answer. In this case, the correct answer is “a notice.” The privacy notice should be informative in a way that is useful to the reader, who will, for the most part, be a consumer and not a lawyer or regulator.

8. CIPT scenarios – part 2

Hi guys. In this lesson, we’ll take a look at part two of our CITTK studies and understand another five questions. Question six: How can the risks of data theft be minimised while collecting data? Stop the video, try to understand the question and find the right answer, and then come back. The correct answer here is to collect only the data that is necessary for the business purpose. Voiper collection practises can minimise privacy risks by helping to ensure that only the necessary data is collected and that only the appropriate people have access to it. When collecting data from users, they should be provided with notice, choice, control, and consent as needed. There should be limits on the data being collected, and it should be secured from inappropriate access.

Let’s go on with question seven. Which is the best way to ensure data is removed from a disk? Again, “best way” is the keyword here. Stop the video, try to understand the question, and then come back for the answer. The correct one in this case is D. To zero the disk, use the Pcount flagcommand to format it. Care must be taken when deleting data from an entire disc or tape and handing it off to a third party. Using standard operating system commands to delete files typically deletes only the header information and leaves the contents of the files intact.

Formatting the entire disc is the best way to ensure the data is removed from the disk. Proper formatting is important because using the standard formatting will clear only the headers from each file and once again leave the data intact on disk. The format command exists within the Windows operating system. We’ll zero the entire disc and then write a random number to the disc count times using the format Pcount flag. Go ahead with question eight. What issue should privacy technologies be aware of when developing a data centre distribution plan? Stop the video.

Again, try to think about the question, and the correct answer is the regulations surrounding the transfer of data across borders. When developing a data centre distribution plan, the location where data is collected and stored, as well as the origin of the data subject, may impact the laws and regulations that apply to the data. Every country has a different set of privacy laws and industry programmes that apply to stored data. The transfer of data between countries and access to data by employees will be impacted by the origin and destination countries’ privacy reviews that include the applicable laws and regulations.

These reviews should be performed to determine the restrictions on data access and transfers. The enterprise can then find the best placement for data to minimise the impact on business plans. Let’s follow up with question nine. Under which conditions would it be appropriate to use cross-enterprise access controls? Take a look at the question and answers and try to find the correct one. In this case, the right one is an organisation that outsources its payroll function. Cross-enterprise access control is a great way to share resources between enterprises. This permits employees in one organisation to have access to resources that belong to another organization. One such multi-enterprise scenario is the outsourcing of major functions when they are outside the company’s expertise and using a service provider is just more cost-effective in a software as a service model.

For example, travel, purchasing, payroll, and healthcare requirements could be provided by companies that specialise in those services. By developing a cross-enterprise capability, employees can access their records without entering nuclear agreements, even though the records are being hosted by a separate organization. And the last question in this lesson is question ten: what is a disadvantage to using an application that has built-in encryption? Take a look at the question, try to understand the fundamental concept here, and then come back for the answer. The correct one is C. Its encryption algorithm can become outdated.

Many applications provide built-in encryption. Alleviating the need for developing encryption routines, databases, word processors, email programs, and communication programmes are examples of applications that provide encryption services as part of their list of features. This can be a huge benefit for organisations that do not have the resources to develop encryption features for their own applications. The drawback to using built-in encryption is that there is often little choice in the type of encryption that can be applied to the data when using an outdated application. The encryption algorithm being used by the application may provide weak protection for the data. when sharing the data. Each person involved in the sharing must have access to the same application, or the data will have to be decrypted before being exposed to a data breach.

9. CIPT scenarios – part 3

Hi guys. Here we are, the last part of our CIPT case studies, and we’ll start with a scenario that will practically be used for the whole lesson. We’ll have five different questions related to this case study, and again, just because it’s on two parts and two different slides, I will recommend that you take the presentation from the resource in this area, take the scenario in a Word document, have it in front of you, and work on the questions with the scenario in front of you. Now I will go through the first question related to this scenario due to biotech’s diverse work projects, which should be used to organise their privacy information for the public. Stop the video right now, try to think about the question, and come back for the answer, which in this case is the Multilayered Privacy Notice. Multilayered privacy notices provide an abbreviated version of an organization’s privacy notice while providing links to more detailed information when required by the reader.

Layered notices offer brevity at one level, making an overview of an organization’s privacy practises accessible to site visitors who are looking for a simple notice, while a detailed notice is just a click away for those who want more in-depth information. Those wishing to implement a layered notice should be certain to give readers enough information at the overview level to make an informed decision about the site and the organisation without having to look at the details. Let’s go ahead with question twelve: Why might a tech company use a privacy nutrition label? Again, take a look at the scenario and have it in front of you. Try to find the correct answer, which in this case is D, to inform users about the privacy practises surrounding the seed registry. A privacy nutrition label is similar to the nutrition labels seen on products in a store. Instead of listing the nutritional value of a product, the labels provide an abbreviated version of a company’s privacy practices. The privacy nutritional label is more informative than the privacy icons, though it is only practical as part of the company’s privacy notice or privacy notice for a newly installed application.

However, like the privacy icons, it is difficult for one label to provide a clear and unambiguous view of a large firm’s privacy practises when there could be multiple collection, usage, sharing, and retention practises across the company. Let’s go on with question 13, which should be used to protect biotech resource data during transfer to devices for use in the field. Take a look at the scenario, try to think about it, and the correct answer is “transport layer security,” or TLS. Whenever data is transferred, it should be done in a secure manner that is proportionate to the sensitivity of the data.

Using a high level of security, such as encryption for all data transfers, can place an unnecessary burden on organisations because it decreases the speed of data transfers and adds complexity to the management of data transfers. For non-sensitive data, an unencrypted transfer may be fine. For sensitive data being transported between different sites of the same company, encrypting the transmission link may be sufficient. Several mechanisms exist that permit the protection of data during transmission. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) can be used to encrypt data while it is being transmitted over the Internet. Let’s go ahead with the next question.

What can be used to track Biotech’s IT personnel’s access to proprietary research data? Take a look again and give your best answer, which in this case should be audit logs. Audit logs can be used during privacy reviews and compliance audits to validate that internal policies and compliance controls have been followed. The final question regarding this scenario, as well as this lesson, is whether you choose to use hashing to protect Biotech’s preparatory or data.

What is the potential downside of hashing? Think about hashing versus encryption. Think about how hashing works and what you can and cannot do. Pause the video and try to give the answer. And in this case, it should be that the data cannot be decrypted. Hashing provides the ability to encrypt data so it can never be decrypted. This technique is valuable for encrypting sensitive data such as credit card or Social Security numbers that do not need to be decrypted. The beauty of hashes is that a lookup can be performed on a record that uses a hashed value as an index. By obtaining the original value, hashing it, and carrying out the lookup. The idea is that only the value’s owner knows the original value. However, the downside of hashing is that the data can then no longer be decrypted.