In privacy protection, what is a "covered entity"?

1. A. Personal data collected by a privacy organization.
2. B. An organization subject to the privacy provisions of HIPAA.
3. C. A privacy office or team fully responsible for protecting personal information.
4. D. Hidden gaps in privacy protection that may go unnoticed without expert analysis.

Correct Answer: B

SCENARIO
Please use the following to answer the next QUESTION:
Paul Daniels, with years of experience as a CEO, is worried about his son Carlton's successful venture, Gadgo. A technological innovator in the communication industry that quickly became profitable, Gadgo has moved beyond its startup phase. While it has retained its vibrant energy, Paul fears that under Carlton's direction, the company may not be taking its risks or obligations as seriously as it needs to. Paul has hired you, a Privacy Consultant, to assess the company and report to both father and son. "Carlton won't listen to me," Paul says, "but he may pay attention to an expert."
Gadgo's workplace is a clubhouse for innovation, with games, toys, snacks. espresso machines, giant fish tanks and even an iguana who regards you with little interest. Carlton, too, seems bored as he describes to you the company's procedures and technologies for data protection. It's a loose assemblage of controls, lacking consistency and with plenty of weaknesses. "This is a technology company," Carlton says. "We create. We innovate. I don't want unnecessary measures that will only slow people down and clutter their thoughts."
The meeting lasts until early evening. Upon leaving, you walk through the office it looks as if a strong windstorm has recently blown through, with papers scattered across desks and tables and even the floor. A "cleaning crew" of one teenager is emptying the trash bins. A few computers have been left on for the night, others are missing. Carlton takes note of your attention to this: "Most of my people take their laptops home with them, or use their own tablets or phones. I want them to use whatever helps them to think and be ready day or night for that great insight. It may only come once!"
What would be the best kind of audit to recommend for Gadgo?

1. A. A supplier audit.
2. B. An internal audit.
3. C. A third-party audit.
4. D. A self-certification.

Correct Answer: C

Which is TRUE about the scope and authority of data protection oversight authorities?

1. A. The Office of the Privacy Commissioner (OPC) of Canada has the right to impose financial sanctions on violators.
2. B. All authority in the European Union rests with the Data Protection Commission (DPC).
3. C. No one agency officially oversees the enforcement of privacy regulations in the United States.
4. D. The Asia-Pacific Economic Cooperation (APEC) Privacy Frameworks require all member nations to designate a national data protection authority.

Correct Answer: A

SCENARIO
Please use the following to answer the next QUESTION:
Richard McAdams recently graduated law school and decided to return to the small town of Lexington, Virginia to help run his aging grandfather's law practice. The elder McAdams desired a limited, lighter role in the practice, with the hope that his grandson would eventually take over when he fully retires. In addition to hiring Richard, Mr. McAdams employs two paralegals, an administrative assistant, and a part-time IT specialist who handles all of their basic networking needs. He plans to hire more employees once Richard gets settled and assesses the office's strategies for growth.
Immediately upon arrival, Richard was amazed at the amount of work that needed to done in order to modernize the office, mostly in regard to the handling of clients' personal data. His first goal is to digitize all the records kept in file cabinets, as many of the documents contain personally identifiable financial and medical data. Also, Richard has noticed the massive amount of copying by the administrative assistant throughout the day, a practice that not only adds daily to the number of files in the file cabinets, but may create security issues unless a formal policy is firmly in place Richard is also concerned with the overuse of the communal copier/ printer located in plain view of clients who frequent the building. Yet another area of concern is the use of the same fax machine by all of the employees. Richard hopes to reduce its use dramatically in order to ensure that personal data receives the utmost security and protection, and eventually move toward a strict Internet faxing policy by the year's end.
Richard expressed his concerns to his grandfather, who agreed, that updating data storage, data security, and an overall approach to increasing the protection of personal data in all facets is necessary Mr. McAdams granted him the freedom and authority to do so. Now Richard is not only beginning a career as an attorney, but also functioning as the privacy officer of the small firm. Richard plans to meet with the IT employee the following day, to get insight into how the office computer system is currently set-up and managed.
Richard believes that a transition from the use of fax machine to Internet faxing provides all of the following security benefits EXCEPT?

1. A. Greater accessibility to the faxes at an off-site location.
2. B. The ability to encrypt the transmitted faxes through a secure server.
3. C. Reduction of the risk of data being seen or copied by unauthorized personnel.
4. D. The ability to store faxes electronically, either on the user's PC or a password-protected network server.

Correct Answer: A

Under the General Data Protection Regulation (GDPR), when would a data subject have the right to require the erasure of his or her data without undue delay?

1. A. When the data subject is a public authority.
2. B. When the erasure is in the public interest.
3. C. When the processing is carried out by automated means.
4. D. When the data is no longer necessary for its original purpose.

Correct Answer: A