IAPP CIPP-C Practice Exam Questions

IAPP CIPP-C Sample Question Answers

Question # 1

According to the Voluntary Code of Conduct on the Responsible Development andManagement of Advanced Generative AI Systems, signatories commit to doing all of thefollowing EXCEPT?

A. Contributing to the development and application of Al standards.  
B. Sharing information and best practices of Al governance.  
C. Supporting public awareness and education on Al.  
D. Adopting low-risk uses of AI.  

Show Answer

Question # 2

According to the federal Privacy Act, before collecting personal information, public-sectororganizations are required to ensure that any of the following are met EXCEPT?

A. Collection directly relates to, and is necessary for, operating a program of thatorganization. 
B. Collection is for the purposes of a law enforcement action.  
C. Collection is expressly authorized under an act.  
D. Collection is authorized by consent.  

Show Answer

Question # 3

A federally regulated company based in Ontario has customers in Ontario, Quebec, NewBrunswick, Alberta and British Columbia. Unfortunately, a third-party vendor that providesmarketing support to the company experiences a privacy breach which impacts thepersonal information of all its customers across the provinces where it operates.The Privacy Officer determines that the breach causes a real risk of significant harm totheir customers and is tasked with reporting the breach to the relevant regulators.With which provincial privacy regulators does the company have to file a report?

A. It is unnecessary to file a report with any provinces because the company is federallyregulated 
B. All of the provinces where its customers are located  
C. New Brunswick and British Columbia only  
D. Quebec and Alberta only  

Show Answer

Question # 4

According to the federal Privacy Commissioner, what protection is missing from the PrivacyAct regarding outsourcing of government work that contains personal information?

A. A statement preventing the vendor to whom the information is outsourced to subcontractits processing. 
B. A statement granting the Privacy Commissioner the right to issue orders following aninvestigation into a possible data breach.  
C. A statement requiring the government agency to complete a Privacy Impact Assessment(PIA) prior to outsourcing to a third party. 
D. A statement indicating that the government institution from which the information isoutsourced remains accountable for its security. 

Show Answer

Question # 5

Under PIPEDA, each of the following are considered to be personal information EXCEPT? 

A. A public official's salary published on a government web site.  
B. A person's telephone number published in a public directory.  
C. A photograph taken in public and published in a newspaper.  
D. Information about a defendant contained in court records.  

Show Answer

Question # 6

Oversight authorities allow the following types of consent EXCEPT? 

A. Implied consent at the time of collection.  
B. Verbal consent given to the person collecting the information.  
C. Written consent included with the information that is collected.  
D. General consent covering all activities associated with the personal information.  

Show Answer

Question # 7

According to the Privacy Act, which of the following disclosures of personal information bya government institution would require the data subject’s consent?

A. When disclosing to a law enforcement body.  
B. When disclosing to comply with a search warrant.  
C. When disclosing to a registered charitable organization.  
D. When disclosing to a member of parliament to assist in resolving a problem.  

Show Answer

Question # 8

ABC Corp uses a third-party provider to perform data analytics and sends the followingdata sets to the third party to run some reports: name, customer ID, age, transactionactivity, transaction date, location, outcome, customer type.If ABC Corp wants the third party to send all the data sets to their US based marketingpartner for a new use, they must?

A. Encrypt data in transit.  
B. Anonymize the personal data before sending.  
C. Seek additional consent from their customers.  
D. Ensure the marketing partner has equal or stronger protections than Canada.  

Show Answer

Question # 9

A small commercial business in Canada was preparing a mailing to its customers when theletters and the envelopes were mismatched, causing 500 of 1000 letters to be sent to thewrong recipients. The letters contained the name and mailing address of the clients as wellas account numbers and account balances.The business has discovered this error as clients called to report receiving the wrong letterand expressing concern that their information has been breached. Which of the following isthe most appropriate next step to take?

A. All 1000 clients must be sent new letters.  
B. The 500 clients who were impacted must be immediately notified.  
C. The Office of the Privacy Commissioner (OPC) must be immediately notified.  
D. A risk assessment must be completed to determine the real risk of significant harm(RROSH) to the clients. 

Show Answer

Question # 10

Which question is NOT part of the Office of the Privacy Commissioner of Canada’s (OPC’s)four-point test for establishing whether providing access to genetic testing results goesbeyond what is necessary or reasonable?

A. Are there less privacy-invasive alternatives?  
B. Are the collection and the use proportionate to the benefits gained?  
C. Are the validity and accuracy of individual test results guaranteed to be accurate?  
D. Is the personal information likely to be effective in achieving a legitimate businesspurpose?  

Show Answer