IAPP CIPT : Certified Information Privacy Technologist (CIPT)

Which of the following is NOT relevant to a user exercising their data portability rights?

• A. Validation of users with unauthenticated identifiers (e.g. IP address, physical address).
• B. Detection of phishing attacks against the portability interface.
• C. Notice and consent for the downloading of data.
• D. Re-authentication of an account, including two-factor authentication as appropriate.

What is the distinguishing feature of asymmetric encryption?

• A. It has a stronger key for encryption than for decryption.
• B. It employs layered encryption using dissimilar methods.
• C. It is designed to cross operating systems.
• D. It uses distinct keys for encryption and decryption.

1905 Blue Stones Way, a California-based home furnishings organization, is implementing a new online helpdesk solution for customer call information. Before implementation, a privacy technologist should complete a privacy impact assessment that includes performing which one of the following activities?

• A. Identifying usability issues that may occur in the solution.
• B. Mapping helpdesk solution data flows to determine where personal data is used.
• C. Analyzing the user population characteristics and needs.
• D. Assessing whether the helpdesk used a security-by-design approach.

SCENARIO
You have just been hired by Ancillary.com, a seller of accessories for everything under the sun, including waterproof stickers for pool floats and decorative bands and cases for sunglasses. The company sells cell phone cases, e-cigarette cases, wine spouts, hanging air fresheners for homes and automobiles, book ends, kitchen implements, visors and shields for computer screens, passport holders, gardening tools and lawn ornaments, and catalogs full of health and beauty products. The list seems endless. As the CEO likes to say, Ancillary offers, without doubt, the widest assortment of low-price consumer products from a single company anywhere.
Ancillary's operations are similarly diverse. The company originated with a team of sales consultants selling home and beauty products at small parties in the homes of customers, and this base business is still thriving.
However, the company now sells online through retail sites designated for industries and demographics, sites such as "My Cool Ride" for automobile-related products or "Zoomer" for gear aimed toward young adults.
The company organization includes a plethora of divisions, units and outrigger operations, as Ancillary has been built along a decentered model rewarding individual initiative and flexibility, while also acquiring key assets. The retail sites seem to all function differently, and you wonder about their compliance with regulations and industry standards. Providing tech support to these sites is also a challenge, partly due to a variety of logins and authentication protocols.
You have been asked to lead three important new projects at Ancillary:
The first is the personal data management and security component of a multi-faceted initiative to unify the company's culture. For this project, you are considering using a series of third- party servers to provide company data and approved applications to employees.
The second project involves providing point of sales technology for the home sales force, allowing them to move beyond paper checks and manual credit card imprinting.
Finally, you are charged with developing privacy protections for a single web store housing all the company's product lines as well as products from affiliates. This new omnibus site will be known, aptly, as "Under the Sun." The Director of Marketing wants the site not only to sell Ancillary's products, but to link to additional products from other retailers through paid advertisements. You need to brief the executive team of security concerns posed by this approach.
Which should be used to allow the home sales force to accept payments using smartphones?

• A. Near-field communication
• B. Radio Frequency Identification
• C. Cross-current translation.
• D. Field transfer protocol.

SCENARIO
Please use the following to answer next question:
EnsureClaim is developing a mobile app platform for managing data used for assessing car accident insurance claims. Individuals use the app to take pictures at the crash site, eliminating the need for a built-in vehicle camera. EnsureClaim uses a third-party hosting provider to store data collected by the app. EnsureClaim customer service employees also receive and review app data before sharing with insurance claim adjusters.
The app collects the following information:
First and last name
Date of birth (DOB)
Mailing address
Email address
Car VIN number
Car model
License plate
Insurance card number
Photo
Vehicle diagnostics
Geolocation
What would be the best way to supervise the third-party systems the EnsureClaim App will share data with?

• A. Anonymize all personal data collected by the app before sharing any data with third-parties.
• B. Develop policies and procedures that outline how data is shared with third-party apps.
• C. Review the privacy notices for each third-party that the app will share personal data with to determine adequate privacy and data protection controls are in place.
• D. Conduct a security and privacy review before onboarding new vendors that collect personal data from the app.