IAPP CIPM Exam Questions
Certified Information Privacy Manager (Page 2 )

What is the best way to understand the location, use and importance of personal data within an organization?

What are you doing if you succumb to "overgeneralization" when analyzing data from metrics?

In addition to regulatory requirements and business practices, what important factors must a global privacy strategy consider?

What have experts identified as an important trend in privacy program development?

SCENARIO
Please use the following to answer the next question:

Julia is a product manager at Avatar, where she is responsible for leading the development of the company's flagship product, Order(ly). Order(ly) is an application that can be used in the home to manage family calendars, do online shopping, and schedule doctor appointments. After having had a successful launch in the United States, Order(ly) is about to be made available for purchase worldwide.

The packaging and user guide for Order(ly) indicate that it is a "privacy friendly" product suitable for the whole family, including children, but does not provide any further detail or privacy notice. In order to use the application, a family creates a single account, and the primary user has access to all information about the other users. Upon start up, the primary user must check a box consenting to receive marketing emails from Avatar and selected marketing partners in order to be able to use the application.

Jacob, the head of privacy at Avatar, was working on an agreement with a European distributor of Order(ly) when he fielded many questions about the product from the distributor. Jacob needed to look more closely at the product in order to be able to answer the questions as he was not involved in the product development process.

In speaking with the product team, he learned that Order(ly) collected and stored all of a user's sensitive medical information for the medical appointment scheduler. In fact, all of the user's information is stored by Order(ly) for the additional purpose of creating additional products and to analyze usage of the product. This data is all stored in the cloud and is encrypted both during transmission and at rest.

Consistent with the CEO's philosophy that great new product ideas can come from anyone, all Avatar employees have access to user data under a program called BGIdeas. Avatar is hoping that at some point in the future, the data will reveal insights that could be used to create a fully automated application that runs on artificial intelligence, but as of yet, BGIdeas is not well-defined and is considered a long-term goal.

What step in the system development process did Julia skip?