CIPM Practice Questions

Privacy by Design (PbD) is a methodology for proactively embedding privacy into the design and operation of IT systems, business practices, and new programs from the very beginning. The question asks for a process to add privacy protections to a new program being developed. PbD is the most effective and appropriate process for this, as its core principle is to anticipate and prevent privacy-invasive events before they happen. This approach aligns perfectly with the organization's goal to mature its program and ensure privacy is an integral "part of the end product of any process of technological development," moving beyond a purely reactive, breach-prevention posture.

B. Privacy Step Assessment: This is not a recognized or standard term within established privacy management frameworks; it is a distractor.

C. Information Security Planning: This is a critical but narrower component of a privacy program. It focuses on security controls, not the full spectrum of privacy principles like purpose limitation or data minimization.

D. Innovation Privacy Standards: This is not a standard industry term for a process. Standards are the requirements or rules, whereas PbD is the proactive methodology for implementing them during development.

1. Densmore

R. (2019). Privacy Program Management: Tools for Managing Privacy Within Your Organization (3rd ed.). IAPP. In Chapter 5

"The Privacy Operational Life Cycle

" the text explains that Privacy by Design is the process of embedding privacy controls into the "Design" phase of any new product or service (pp. 151-153).

2. Cavoukian

A. (2009). Privacy by Design: The 7 Foundational Principles. Information and Privacy Commissioner of Ontario

Canada. The first principle

"Proactive not Reactive; Preventative not Remedial

" directly addresses the scenario's need to build privacy into a new program from the start rather than correcting issues after the fact (p. 2).

3. National Institute of Standards and Technology. (2017). NISTIR 8062: An Introduction to Privacy Engineering and Risk Management in Federal Systems. Section 2.2

"Relationship to the System Development Life Cycle

" emphasizes that "privacy is a cross-cutting concern that needs to be addressed at all stages of the SDLC

" which is the operational application of Privacy by Design principles (p. 7).

The question asks to identify the option that is NOT a security benefit of transitioning to internet faxing. While greater accessibility from an off-site location is a benefit of internet faxing, it is primarily an operational or convenience benefit, not a security one. In fact, increased accessibility can introduce new security risks if not managed with strong access controls. The other options—encryption, reduction of unauthorized physical access, and secure electronic storage with password protection—are all direct security enhancements that protect the confidentiality and integrity of the personal data contained in the faxes.

B: The ability to encrypt faxes during transmission is a core security benefit, protecting data from interception, which is not a feature of traditional analog faxing.

C: Internet faxing delivers documents to a specific user's secure inbox, eliminating the risk of papers being left on a communal machine for anyone to see or take.

D: Storing faxes on a password-protected server allows for robust access controls, audit trails, and secure lifecycle management, which are significant security upgrades from physical file cabinets.

1. IAPP

Privacy Program Management: Tools for Managing Privacy Within Your Organization

3rd ed.

2019

by Russell Densmore

CIPP/US

CIPT

FIP.

Chapter 5: Privacy and Security. This chapter discusses the implementation of technical controls to protect personal information. It emphasizes that controls like encryption (related to option B)

access control (related to options C and D)

and secure storage are fundamental to data security. The text distinguishes between security controls and operational features

implicitly supporting that remote accessibility (option A) is an operational feature whose security depends on the implementation of other controls.

2. National Institute of Standards and Technology (NIST)

Special Publication 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations

2020.

AC (Access Control) Family: This control family details the necessity of limiting information system access to authorized users. This directly relates to options C and D

where internet faxing enables better electronic access control than a communal physical machine.

SC (System and Communications Protection) Family

specifically SC-8 (Transmission Confidentiality and Integrity) and SC-13 (Cryptographic Protection): These controls advocate for protecting information during transmission

which aligns with the encryption benefit described in option B. The standard does not list "greater accessibility" as a security control; rather

it is a factor that security controls must manage.

3. Al-Haj

A.

& Al-Roubaiey

A. A. (2011). Security of Internet Faxing. International Journal of Network Security & Its Applications

3(1)

115–126. https://doi.org/10.5121/ijnsa.2011.3110

Section 3

"Security in Internet Faxing": This academic paper explicitly outlines the security advantages of Internet faxing over traditional PSTN-based faxing. It highlights encryption (TLS/SSL)

authentication

and secure storage as key security benefits. It discusses accessibility as a functional advantage but frames the security challenge as one of ensuring that this increased access is properly controlled and authenticated

confirming that accessibility itself is not the security benefit.

The company is collecting metrics on data privacy and system outages over a period of time following a security incident. Trend analysis is the most appropriate method for examining this time-series data to identify patterns, changes, and tendencies. By analyzing these trends, the organization can determine if the implemented security controls are effective, identify emerging risks, and make data-driven decisions to proactively prevent future incidents. This directly aligns with the company's goal of using the collected metrics to stop future hacks.

A. Return on Investment (ROI). This is a financial metric used to evaluate the profitability of an investment, not a method for analyzing operational security data to prevent future incidents.

B. Compliance analysis. This assesses adherence to laws and regulations. While important, it doesn't focus on analyzing operational metrics over time to identify patterns and prevent future events.

C. Business Resiliency. This is a strategic objective or outcome—the ability to withstand disruptions. Trend analysis is a specific method used to help achieve this broader goal.

1. Densmore

R. (2019). Privacy Program Management: Tools for Managing Privacy Within Your Organization (3rd ed.). IAPP (International Association of Privacy Professionals).

Page 180

Section "Types of Metrics": The text explicitly lists "Data for trend analysis over time" as a key type of metric for a privacy program. It emphasizes that metrics are used to "identify risks and demonstrate the value of the privacy program."

Page 178

Chapter 6 "Metrics": It states

"Metrics should be tracked over time to show progress or identify areas needing improvement." This directly supports the use of trend analysis on data collected over a period.

2. Solove

D. J.

& Schwartz

P. M. (2015). Information Privacy Law (5th ed.). Wolters Kluwer.

Chapter 10

Section on "Information Security": While not using the exact term "trend analysis

" the chapter discusses the necessity of ongoing monitoring and assessment of security measures. Analyzing data collected from this monitoring over time is a form of trend analysis used to "identify and respond to new threats and vulnerabilities" (p. 897)

which is the core issue in the question.

3. MIT Sloan School of Management. (2016). 15.567 The Economics of Information: Strategy

Structure and Pricing. MIT OpenCourseWare.

In discussions on managing information as an asset

course materials often cover the importance of monitoring systems and analyzing performance data over time to manage risk and ensure security. This analytical process of looking at data points over a period is trend analysis

used for predictive and preventative measures. (Reference to general principles taught in advanced management and information systems courses).

The General Data Protection Regulation (GDPR) in Article 17(1)(a) explicitly states that a data subject has the right to obtain the erasure of their personal data when "the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed." This directly supports the principle of purpose limitation, a fundamental concept in data protection law. Once the original, specified, and legitimate purpose for processing has been fulfilled and there is no other legal basis for retention, the data must be erased upon the data subject's request.

A. The status of the data subject as a public authority is not a condition for exercising the right to erasure; this right applies to all natural persons.

B. Public interest is cited in Article 17(3) as a reason to refuse an erasure request, for example, for archiving or public health purposes.

C. Processing by automated means is a key condition for the right to data portability under Article 20, not the right to erasure under Article 17.

1. Regulation (EU) 2016/679 (General Data Protection Regulation)

Official Journal of the European Union

L 119/1.

Article 17(1)(a): "The data subject shall have the right to obtain from the controller the erasure of personal data... where... the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed".

Article 17(3)(b) & (d): Lists exceptions to the right of erasure

including processing necessary "for the performance of a task carried out in the public interest" and "for archiving purposes in the public interest".

Article 20(1)(b): Specifies that the right to data portability applies when "the processing is carried out by automated means."

2. European Data Protection Board (EDPB). (2020). Guidelines 05/2020 on the right to data portability under the GDPR.

Section II.A

Paragraph 11: This document clarifies that one of the cumulative conditions for the right to data portability is that "the processing is carried out by automated means

" distinguishing it from the grounds for other rights like erasure.

3. Voigt

P.

& von dem Bussche

A. (2017). The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer International Publishing.

Chapter on "Article 17 Right to erasure (‘right to be forgotten’)"

Page 203: The text explains that the primary ground for erasure is when the purpose for which the data was collected no longer exists

directly referencing Article 17(1)(a).

The General Data Protection Regulation (GDPR) has extraterritorial reach under Article 3(2). This article states that the regulation applies to the processing of personal data of data subjects in the European Union (EU) by a controller not established in the EU, where the processing activities are related to the offering of goods or services to those data subjects. Mesa's "global E-commerce presence" strongly implies that it offers its products to customers in the EU, thereby triggering the GDPR's territorial scope. The company's location is irrelevant if it targets individuals within the EU.

A. Mesa being US-based is the reason the extraterritorial scope of the GDPR is relevant, not the reason for compliance itself.

B. While direct marketing is regulated by the GDPR, this activity alone does not establish the jurisdictional basis for the regulation to apply to a non-EU company.

C. The use of automated systems is a method of processing data; it pertains to the GDPR's material scope, not its territorial scope for a non-EU entity.

1. Regulation (EU) 2016/679 (General Data Protection Regulation)

Article 3

"Territorial scope

" paragraph 2(a): "This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union

where the processing activities are related to: (a) the offering of goods or services

irrespective of whether a payment of the data subject is required

to such data subjects in the Union".

2. European Data Protection Board (EDPB)

Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)

Version 2.1 (12 November 2019)

Section 2.1

Paragraph 20: "In order to determine whether goods or services are offered to a data subject in the Union

the EDPB will consider a number of factors... For example

the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language

or the mentioning of customers or users who are in the Union." A global e-commerce site would likely meet these criteria.

3. Kuner

C.

Bygrave

L. A.

& Docksey

C. (2020). The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press. In the commentary on Article 3

the authors explain that the "targeting" approach means that the mere accessibility of a website in the EU is not sufficient

but factors indicating an intention to offer goods or services to people in the EU will trigger the application of the GDPR. A global e-commerce presence implies such an intention.

The core issue identified is an outdated Incident Response Plan (IRP) leading to inconsistent and slow responses. Making the IRP a "live document" that is evaluated and updated after each incident directly addresses this root cause. This practice embeds a "lessons learned" process into the incident response lifecycle, ensuring the plan continuously evolves and improves based on real-world application. This proactive approach mitigates the risk of the plan becoming obsolete and ineffective, thereby improving the consistency and efficiency of future incident responses, which is the board's primary concern.

B. Make copies of the IRP in various places so it can be accessed remotely or when offline.

This addresses accessibility, which is important, but it does not solve the fundamental problem of the plan itself being outdated and ineffective.

C. Add comments about incidents to the IRP to record what action was taken.

This is poor practice. The IRP is a procedural document; incident-specific details belong in a separate incident log or post-mortem report, which then informs updates to the plan.

D. Make sure that everyone listed in the IRP has a copy of the IRP.

This addresses distribution. While necessary, providing everyone with a copy of a flawed and outdated plan will not improve the quality or speed of the response.

1. IAPP Official Textbook: Densmore

R. (2021). Privacy Program Management: Tools for Managing Privacy Within Your Organization

3rd ed. International Association of Privacy Professionals. In Chapter 6

"Privacy Operational Life Cycle: Respond

" the text emphasizes the importance of the post-incident phase

stating

"The final phase of the incident response plan is post-incident activity... This phase includes a 'lessons learned' session... The incident response plan should be updated to reflect any changes." (p. 203). This directly supports treating the plan as a live document that is evaluated and updated after incidents.

2. Official Vendor Documentation (NIST): National Institute of Standards and Technology (NIST). (2012). Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide. Section 3.4

"Post-Incident Activity

" highlights that a key part of this phase is "using information gained during the incident to better prepare for handling future incidents." It explicitly recommends

"Creating a follow-up report... provides a reference that can be used to improve security measures and the incident handling process itself." (p. 41). This aligns with the principle of evaluating the plan's completeness during each incident to drive improvement.

Under GDPR Article 34, a controller must notify data subjects of a breach if it is "likely to result in a high risk to the rights and freedoms of natural persons." However, Article 34(3)(a) provides a specific exemption if the controller has implemented measures that "render the personal data unintelligible to any person who is not authorised to access it, such as encryption."

The theft of a properly encrypted USB key means the data remains confidential and inaccessible. Assuming the encryption is state-of-the-art and the decryption key has not been compromised, the risk to data subjects is low. Therefore, this situation is the least likely to require notification to the data subjects.

B. A direct marketing email is sent with recipients visible in the ‘cc’ field

This is a confidentiality breach exposing personal data (email addresses) to unauthorized third parties, creating a risk of spam or phishing that likely requires notification.

C. Personal data of a group of individuals is erroneously sent to the wrong mailing list

This is an uncontrolled disclosure of personal data to an incorrect audience, which constitutes a clear confidentiality breach and presents a risk requiring notification.

D. A hacker publishes usernames, phone numbers and purchase history online after a cyber-attack

This is a severe breach where sensitive data is made public. It presents a high risk of identity theft, fraud, and other harms, making notification mandatory.

1. General Data Protection Regulation (EU) 2016/679.

Article 34(1): "When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons

the controller shall communicate the personal data breach to the data subject without undue delay."

Article 34(3)(a): States that the communication to the data subject referred to in paragraph 1 shall not be required if "the controller has implemented appropriate technical and organisational protection measures

and those measures were applied to the personal data affected by the personal data breach

in particular those that render the personal data unintelligible to any person who is not authorised to access it

such as encryption."

2. European Data Protection Board (formerly Article 29 Working Party)

Guidelines on Personal data breach notification under Regulation 2016/679 (WP250rev.01)

adopted on 3 October 2017

as last Revised and Adopted on 6 February 2018.

Page 13

Section III.B: "If the controller has implemented appropriate technological protection measures

such as encryption

that render the data unintelligible to any person not authorized to access it

notification to the data subject is not required."

Page 22

Annex B

Example 2: Describes a scenario where a hospital employee's encrypted USB stick is stolen. It concludes: "As the data on the USB stick was encrypted using a state-of-the-art algorithm

the hospital determines that the data is unintelligible and therefore there is no likely high risk to patients. The hospital does not need to notify the patients."

Most modern, principles-based privacy legislation, such as the GDPR, is intentionally technology-neutral. These laws require organizations to implement "appropriate technical and organizational measures" based on a risk assessment, rather than prescribing a specific list of technologies. This approach ensures the law remains durable as technology evolves and allows organizations the flexibility to select controls best suited to their specific processing activities, data types, and identified risks. Mandating specific controls would quickly render the legislation obsolete and would be ill-suited for the diverse range of organizations and technologies it governs.

A. Data governance frameworks are designed to manage and protect data assets, making technical security controls a critical and integral component.

B. Core technical controls (e.g., encryption, access control) are often based on global standards, making them broadly applicable and sufficient across many jurisdictions.

D. The effective deployment and configuration of technical security controls require specialized expertise to prevent vulnerabilities and ensure they meet security objectives.

1. General Data Protection Regulation (EU) 2016/679

Article 32(1). The regulation states that controllers and processors shall implement "appropriate technical and organisational measures to ensure a level of security appropriate to the risk

" providing examples like encryption and pseudonymization

but not a mandatory

exhaustive list.

2. IAPP. (2019). Privacy Program Management: Tools for Managing Privacy Within Your Organization (3rd ed.). Chapter 5

Section on "Information Security

" explains that selecting controls is a risk-based decision and that laws like the GDPR do not prescribe specific technologies

instead requiring "reasonable" or "appropriate" security.

3. Voigt

P.

& von dem Bussche

A. (2017). The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer International Publishing. In the commentary on Article 32 (pp. 345-348)

the authors highlight the technology-neutral and risk-based approach

noting that the GDPR "does not prescribe any specific technical or organisational measures." (DOI: 10.1007/978-3-319-57959-7).

The right to erasure, or the "right to be forgotten," is not an absolute right and is subject to specific exemptions. A primary exemption occurs when the continued processing of personal data is necessary for an organization to comply with a legal obligation. For instance, laws related to taxation, anti-money laundering, or specific industry regulations may require an organization to retain data for a prescribed period. In such cases, the legal requirement to hold the data supersedes the individual's request for deletion, and the organization can lawfully reject the erasure request for the duration of the legal retention period.

A. An outdated original purpose.

Processing for an outdated purpose is a reason to grant an erasure request, as it violates the principle of storage limitation.

C. The offer of information society services.

This is a lawful basis for processing data, particularly for children, but it does not create an exemption from the right to erasure.

D. The establishment of personal legal claims.

The exemption applies to the controller's need to establish, exercise, or defend legal claims, not ambiguously "personal" ones, which could imply the data subject's.

---

1. General Data Protection Regulation (EU) 2016/679 (GDPR): Article 17(3)(b) explicitly states that the right to erasure shall not apply to the extent that processing is necessary "for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller."

2. Densmore

R. (2019). Privacy Program Management: Tools for Managing Privacy Within Your Organization (2nd ed.). IAPP. In Chapter 5

"Data Subject Rights

" the text details the exceptions to the right of erasure

highlighting that a request can be denied if the data is required "for compliance with a legal obligation."

3. Information Commissioner's Office (UK). (2023). Guide to the UK General Data Protection Regulation (UK GDPR): Right to erasure. In the section "When can we refuse to comply with a request for erasure?"

the guidance lists as the first exemption: "We need to process the data to comply with a legal obligation."

The most fundamental reason for classifying and tagging data as "special" or "sensitive" is to apply the appropriate level of security and privacy controls. This process, known as data classification, is a cornerstone of information governance and privacy management. By identifying high-risk data, such as the "special categories of personal data" defined in the GDPR, the organization can implement specific technical and organizational measures (e.g., encryption, access controls, stricter usage policies) to ensure it is protected from unauthorized access and used only for legitimate, authorized purposes. This directly supports the core privacy principles of confidentiality and integrity.

B. To apply the organization's data deletion standard.

This is too narrow. Data classification informs the entire data lifecycle, including collection, use, and storage, not just the final stage of deletion.

C. To create a robust record of processing activities.

While data classification is a necessary input for a Record of Processing Activities (RoPA), the primary goal is to apply operational controls, not merely to complete documentation.

D. To prepare for an upcoming regulatory audit under GDPR.

An audit is a verification event, not the foundational purpose of the control. A mature privacy program implements data classification proactively to manage risk, which in turn ensures audit readiness. The audit is a trigger, but the underlying reason for the activity is to establish control (Option A).

1. Densmore

R. (2019). Privacy Program Management: Tools for Managing Privacy Within Your Organization (3rd ed.). IAPP.

In Chapter 8

"Privacy in Technology

" the section on Data Classification explicitly states that the purpose of a data classification scheme is to enable the application of appropriate security controls based on the data's sensitivity. It links classification directly to implementing controls like access management and encryption

which aligns with ensuring data is controlled and used for authorized purposes.

2. NIST Special Publication 800-53

Rev. 5. (2020). Security and Privacy Controls for Information Systems and Organizations. National Institute of Standards and Technology.

Control families such as Access Control (AC)

System and Information Integrity (SI)

and Media Protection (MP) rely on data classification. For example

control AC-3 (Access Enforcement) requires the system to enforce access controls based on information attributes

which are determined through classification and tagging. This demonstrates that the operational purpose of classification is to enable such controls. (See Section 3

Control Family AC).

3. International Organization for Standardization. (2013). ISO/IEC 27001:2013 Information technology — Security techniques — Information security management systems — Requirements.

Annex A

Control A.8.2.1 "Classification of information

" states that information should be classified in terms of legal requirements

value

criticality

and sensitivity to unauthorized disclosure or modification. The subsequent controls (A.8.2.2 "Labeling of information" and A.8.2.3 "Handling of assets") are about applying procedures based on that classification

reinforcing that the purpose of classification is to enable proper control and handling.