DCPP-01 DSCI certified Privacy Professional (DCPP) Questions and Answers

Personal Information Owner

Personal Information Controller

Personal Information Processor

Personal Information Auditor

Covered Entities only

Business Associates only

Covered Entities & Business Associates

Federal Health Bodies only

Right to be informed prior to sharing of data

Right to modify data

Right to be forgotten

Right to object data collection and processing

Data sharing does not require consent from the consumers.

As soon as the GLBA privacy notice is disclosed initially and annually

FTC permission is required

Consumers' consent must be obtained first

Government entities using personal information

Personal Information about an individual that is used by a business

None of the above

As part of APEC, member countries do not need to sign binding treaties or directives on privacy

Personal information is not covered by the APEC privacy framework

Members of APEC do not cooperate with each other in the enforcement of privacy laws

APEC provides no regulations on e-commerce

Argentina

Canada

Brazil

New Zealand

Directive on EU e-commerce mentions it as a requirement

EU Data Protection Directive states that it is a requirement

OECD's Privacy Framework mentions it as a requirement

Neither of the above

These actions were not avoided by using data loss prevention tools.

No reasonable security practices were implemented to protect data.

Employees of the company were allowed to view sensitive personal information.

Background checks were not conducted on the individuals.

Data Processor

Data Controller

Data Subject

Either A or B

Maintaining privacy is difficult with emerging platforms and services

Maintaining privacy is difficult, as exercising complete control over personal information in online environment is an uphill task

Technology advancements and privacy protection are independent concepts that are not related

Maintaining privacy in cyberspace becomes easier with proper use of tools and technologies

A is the data controller since it collects data directly from X & Y

B is the data controller while A is the sub processor as B has outsourced the data collection and processing to A

B is the data controller that uses A as data processor to collect and process data of data subjects X and Y

Both A & B are data controllers since both need to maintain highest principles of data protection

PII is necessarily a single data element, not a combination of data elements, which can uniquely identify an individual

PII is a subset of Sensitive Personal Information

PII is any information about a legal entity including details of its registration or any information that may allow its easy identification

None of the above

Fundamental civil liberty

Universal declaration of human rights

Right to be left alone

Binding corporate rules

Information Privacy

Physical Privacy

Social Privacy

Psychological Privacy