What is the goal of privacy enhancing technologies (PETs) like multiparty computation and differential privacy?
Answer(s): B
Answer(s): B – To protect sensitive data while maintaining its utility.JustificationPurpose of PETs – Multiparty computation (MPC), differential privacy (DP), federated learning, secure enclaves, and similar techniques are deliberately designed to enable analysis, sharing, or processing of data without exposing raw, identifying values. The core objective is to preserve the analytical value of the data (e.g., statistical accuracy, predictive power) while reducing the risk of re-identification or leakage. This aligns directly with option B.Why B is optimal –Privacy: The cryptographic or statistical mechanisms guarantee that individual-level information cannot be recovered beyond a defined privacy budget or trust boundary. Utility: By calibrating parameters (e.g., epsilon in DP, threshold depth in MPC), the resulting insights remain useful for the intended analytical tasks. PETs are explicitly referenced in privacy frameworks (e.g., NIST Privacy Framework, ISO/IEC 27701) as *privacy-enhancing technologies that balance risk and usefulness.Why the other choices are less suitableA – Facilitate audits – Auditing is a compliance activity; PETs may simplify audit trails, but that is not their primary design goal. C – Standardize privacy activities – Standardization concerns processes and policies (e.g., privacy impact assessments), not the technical mechanisms themselves. D – Protect the security perimeter and data items – This describes conventional security controls (e.g., firewalls, encryption at rest) rather than the privacy-utility trade-off that PETs address.
NIST. NIST Privacy Framework: A Guide for Managing Privacy Risk. 2023. https://doi.org/10.6028/NIST.CSWP.08042023 Dwork, C., & Roth, A. The Algorithmic Foundations of Differential Privacy. 2014. https://www.cis.upenn.edu/~dwork/pubs/PrivacyBook.pdf
To comply with the Sarbanes-Oxley Act (SOX), public companies in the United States are required to annually report on the effectiveness of the auditing controls of their financial reporting systems. These controls must be implemented to prevent unauthorized use, disclosure, modification, and damage or loss of financial data. Why do these controls ensure both the privacy and security of data?
Answer(s): C
Answer(s): C – “Disclosure of data is an aspect of privacy; unauthorized use, modification, and damage or loss of data are aspects of security.”Why option C best captures the relationshipPrivacy frameworks (e.g., IAPP, GDPR, ISO 27701) focus on the rights of data subjects regarding how personal data is collected, processed, and shared. The core privacy concern is who has access to the data and whether that access respects the individual’s expectations of confidentiality. This is expressed as disclosure – the act of making personal data visible or known to others. Security controls aim to protect data from threats that could compromise its integrity or availability. The typical security objectives are confidentiality, integrity, and availability :Confidentiality is about preventing unauthorized use and disclosure —but when discussing the “confidentiality” pillar, the term “disclosure” is already covered under privacy. Integrity directly addresses unauthorized modification of data. Availability directly addresses damage or loss of data. Hence, the combination “unauthorized use, modification, and damage or loss” maps cleanly onto the security domain.Why the other options are less suitableOption A – Incorrectly places modification under privacy. Modification is primarily a data-integrity issue (security), not a privacy-subject-rights issue. Option B – Incorrectly ties unauthorized use to privacy. While unauthorized use can be a privacy concern, the SOX control language emphasizes that such use, disclosure, modification, and damage/loss are all security-related outcomes that the controls must prevent. Option D – Incorrectly categorizes damage or loss as a privacy aspect, and also incorrectly repeats “privacy” for disclosure, unauthorized use, and modification, which dilutes the distinction between the two domains.Technical justification suitable for an IAPP-style exam reviewThe Sarbanes-Oxley Act mandates that publicly traded companies demonstrate effective internal controls over financial reporting. Those controls must address confidentiality (preventing unauthorized disclosure) , integrity (preventing unauthorized modification) , and availability (preventing damage or loss) of the underlying financial data. In privacy terminology, disclosure aligns with the subject-centric expectation that personal/financial information should not be released without consent. Security terminology groups together the mechanisms that protect confidentiality, integrity, and availability, which correspond to the actions unauthorized use , modification , and damage/loss . Therefore, the mapping in option C correctly separates privacy (disclosure) from security (unauthorized use, modification, damage or loss), providing the technically accurate answer.
International Association of Privacy Professionals (IAPP), Data Privacy Fundamentals – https://iapp.org/resources/article/data-privacy-fundamentals/ NIST Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems andOrganizations – https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/finalThese sources detail the standard distinctions between privacy (subject-rights) and security (confidentiality, integrity, availability) controls relevant to compliance frameworks such as SOX.
Which of the following entities would most likely be exempt from complying with the General Data Protection Regulation (GDPR)?
Answer(s): D
ReasoningOption D describes a North-American firm that only provides services to customers in South Africa and relies on a cloud provider located in Europe. Its activities do not target EU data subjects , nor does it have an establishment, branch, or office in the EU. Consequently, the GDPR’s territorial scope does not apply, and the company is not obliged to comply with GDPR obligations.Option A involves a South-American entity that regularly collects personal data from EU residents , which brings it within the GDPR’s material scope (Article 3(1) – processing of personal data of EU-resident individuals).Option B is based in an EU member state; even though its data is stored in Australia, the fact that the company is headquartered in the EU makes it subject to GDPR when it offers goods or services to EU individuals or monitors their behavior.Option C has a physical presence (satellite office) in an EU member state and serves EU customers, establishing a controller or processor established in the EU . The GDPR therefore applies irrespective of where the data is ultimately processed.Hence, the entity most likely exempt from GDPR compliance is Option D .
Regulation (EU) 2016/679 – Articles 3(1) to 3(2) – intentional scope: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679 EU Commission – “Who must comply with the GDPR?” – https://ec.europa.eu/info/law/law-topic/data-protection/information-and-trainings/guide-to-data-protection_en
SCENARIOWebTracker Limited is a cloud-based online marketing service located in London. Last year, WebTracker migrated its IT infrastructure to the cloud provider AmaZure, which provides SQL Databases and Artificial Intelligence services to WebTracker. The roles and responsibilities between the two companies have been formalized in a standard contract, which includes allocating the role of data controller to WebTracker.The CEO of WebTracker, Mr. Bond, would like to assess the effectiveness of AmaZure's privacy controls, and he recently decided to hire you as an independent auditor. The scope of the engagement is limited only to the marketing services provided by WebTracker, you will not be evaluating any internal data processing activity, such as HR or Payroll.This ad-hoc audit was triggered due to a future partnership between WebTracker and SmartHome -- a partnership that will not require any data sharing. SmartHome is based in the USA, and most recently has dedicated substantial resources to developing smart refrigerators that can suggest the recommended daily calorie intake based on DNA information. This and other personal data is collected by WebTracker.To get an idea of the scope of work involved, you have decided to start reviewing the company's documentation and interviewing key staff to understand potential privacy risks.The results of this initial work include the following notes:There are several typos in the current privacy notice of WebTracker, and you were not able to find the privacy notice for SmartHome.You were unable to identify all the sub-processors working for SmartHome. No subcontractor is indicated in the cloud agreement with AmaZure, which is responsible for the support and maintenance of the cloud infrastructure.There are data flows representing personal data being collected from the internal employees of WebTracker, including an interface from the HR system. Part of the DNA data collected by WebTracker was from employees, as this was a prototype approved by the CEO of WebTracker.All the WebTracker and SmartHome customers are based in USA and Canada.Based on the initial assessment and review of the available data flows, which of the following would be the most important privacy risk you should investigate first?
Justification – Why option C must be investigated firstThe prototype that uses employees’ DNA constitutes processing of special-category personal data (e.g., genetic data). Under GDPR Article 9 this is only lawful if a specific condition applies (e.g., explicit consent or a legal basis that is rare for employment contexts). The fact that the CEO approved the prototype means the lawful basis has not been demonstrated ; the processing could therefore be unlawful, exposing the organization to severe administrative fines and reputational damage. Evaluating the basis for this processing immediately targets the core privacy risk – the potential infringement on employees’ fundamental rights by handling highly sensitive data without a clear legal ground. Once the lawful basis is clarified, any related data-flow documentation, consent records, and risk-mitigation measures can be assessed. This step therefore precedes reviewing HR notices, sub-processor lists, or transfer approvals, which are secondary to establishing a valid processing ground.Why the other options are less critical for the first stepOption A – Correcting typos in the privacy notice and confirming HR/Payroll compliance is important for internal compliance but does not address the heightened risk posed by the DNA-based prototype, which involves special-category data and could breach Article 9 regardless of notice accuracy.Option B – Identifying AmaZure subcontractors and adding them to the contract is a necessary governance activity, yet it is not the most pressing privacy concern ; the question focuses on the risk linked to the processing activity, not on contractual sub-processor visibility. Option D – Verifying data-transfer approvals to the USA/Canada is relevant for international transfers, but the scenario states that most customers are already in those jurisdictions and the contract likely already governs such transfers. The primary privacy exposure remains the un-justified processing of genetic data.Conclusion The most urgent privacy risk is the lack of a demonstrable lawful basis for processing employees’ DNA data . Confirming that the processing complies with GDPR’s special-category rules must be examined before addressing ancillary issues such as notice corrections, sub-processor lists, or transfer approvals.
European Union, “Regulation (EU) 2016/679 (GDPR) – Article 9: Processing of special categories of personal data” – https://eur-lex.europa.eu/eli/reg/2016/679/oj International Association of Privacy Professionals (IAPP), “CIPP/E Body of Knowledge – Legal Basis for Processing” – https://iapp.org/resources/cipp-body-of-knowledge/
SCENARIOWebTracker Limited is a cloud-based online marketing service located in London. Last year, WebTracker migrated its IT infrastructure to the cloud provider AmaZure, which provides SQL Databases and Artificial Intelligence services to WebTracker. The roles and responsibilities between the two companies have been formalized in a standard contract, which includes allocating the role of data controller to WebTracker.The CEO of WebTracker, Mr. Bond, would like to assess the effectiveness of AmaZure's privacy controls, and he recently decided to hire you as an independent auditor. The scope of the engagement is limited only to the marketing services provided by WebTracker, you will not be evaluating any internal data processing activity, such as HR or Payroll.This ad-hoc audit was triggered due to a future partnership between WebTracker and SmartHome -- a partnership that will not require any data sharing. SmartHome is based in the USA, and most recently has dedicated substantial resources to developing smart refrigerators that can suggest the recommended daily calorie intake based on DNA information. This and other personal data is collected by WebTracker.To get an idea of the scope of work involved, you have decided to start reviewing the company's documentation and interviewing key staff to understand potential privacy risks.The results of this initial work include the following notes:There are several typos in the current privacy notice of WebTracker, and you were not able to find the privacy notice for SmartHome.You were unable to identify all the sub-processors working for SmartHome. No subcontractor is indicated in the cloud agreement with AmaZure, which is responsible for the support and maintenance of the cloud infrastructure.There are data flows representing personal data being collected from the internal employees of WebTracker, including an interface from the HR system. Part of the DNA data collected by WebTracker was from employees, as this was a prototype approved by the CEO of WebTracker.All the WebTracker and SmartHome customers are based in USA and Canada.Which of the following issues is most likely to require an investigation by the Chief Privacy Officer (CPO) of WebTracker?
Why option B is the only activity that must be examined by the CPOExternal distribution of personal data – The newsletter sent by AmaZure to WebTracker’s customers involves the processing of personal data that originates from WebTracker’s marketing campaigns. Because the data controller (WebTracker) is responsible for ensuring lawful, transparent and purpose-limited processing, any third-party distribution must be documented, consent-based and reflected in the privacy notice. A missing or incomplete privacy notice makes this risk material and requires CPO oversight.Sub-processor involvement – The contract with AmaZure does not expressly identify the newsletter activity as a sub-processing operation. Under GDPR-style obligations, any downstream processor handling personal data on behalf of the controller must be covered by a sub-processing agreement, impact assessments, and appropriate contractual safeguards. The CPO therefore needs to investigate whether this activity complies with controller-processor-sub-processor hierarchies.Potential breach of transparency obligations – The audit uncovered typos in the current privacy notice and an inability to locate a privacy notice for SmartHome. Adding a marketing-oriented newsletter to customers without a clear, compliant notice constitutes a serious transparency failure that the CPO must remediate.Why the other options are less critical for CPO investigationOption A – Encryption of data at rest – While encryption is a technical safeguard, the fact that it is defined by the IT manager does not, on its own, raise a privacy-governance issue that requires CPO scrutiny. It is an operational control rather than a compliance breach.Option C – Employees’ personal data in a cloud HR system – The HR system falls outside the audit’s defined scope (marketing services only). Moreover, employee data are typically processed under separate employment-contractual bases and are not part of the external marketing-partner risk set.Option D – File-integrity monitoring in SQL servers – Deploying integrity monitoring is a security control. Its existence does not indicate a privacy-related deficiency; it is therefore not a matter for the CPO.Most relevant documentation
IAPP, Guide to the GDPR – Lawful Basis for Processing, https://iapp.org/resources/article/gdpr-lawful-basis-for-processing/ European Commission, Data protection – Privacy notice requirements, https://ec.europa.eu/info/law/law-topic/data-protection_en
Post your Comments and Discuss IAPP CIPT exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CIPT content, but please register or login to continue.