SCENARIOTom looked forward to starting his new position with a U.S --based automobile leasing company (New Company), now operating in 32 states. New Company was recently formed through the merger of two prominent players, one from the eastern region (East Company) and one from the western region (West Company). Tom, a Certified Information Privacy Technologist (CIPT), is New Company's first Information Privacy and Security Officer. He met today with Dick from East Company, and Harry, from West Company. Dick and Harry are veteran senior information privacy and security professionals at their respective companies, and continue to lead the east and west divisions of NewCompany. The purpose of the meeting was to conduct a SWOT (strengths/weaknesses/opportunities/threats) analysis for New Company. Their SWOT analysis conclusions are summarized below.Dick was enthusiastic about an opportunity for the New Company to reduce costs and increase computing power and flexibility through cloud services. East Company had been contemplating moving to the cloud, but West Company already had a vendor that was providing it with software-as- a-service (SaaS). Dick was looking forward to extending this service to the eastern region. Harry noted that this was a threat as well, because West Company had to rely on the third party to protect its data.Tom mentioned that neither of the legacy companies had sufficient data storage space to meet the projected growth of New Company, which he saw as a weakness. Tom stated that one of the team's first projects would be to construct a consolidated New Company data warehouse. Tom would personally lead this project and would be held accountable if information was modified during transmission to or during storage in the new data warehouse.Tom, Dick and Harry agreed that employee network access could be considered both a strength and a weakness. East Company and West Company had strong performance records in this regard; both had robust network access controls that were working as designed. However, during a projected year-long transition period, New Company employees would need to be able to connect to a New Company network while retaining access to the East Company and West Company networks.Which statement is correct about addressing New Company stakeholders' expectations for privacy?
Answer(s): B
Why option B is the best answerThe CIPT framework emphasizes that privacy responsibility extends to all data subjects whose information is collected, processed, or shared, regardless of which organization actually controls the data. New Company must proactively communicate with stakeholders (consumers, partners, regulators) about how privacy will be protected for data that moves between East Company, West Company, and the new consolidated environment. Managing expectations involves clear notice, consent mechanisms, and enforceable contractual commitments throughout the entire transition period – even when the personal data resides in a legacy system or with a third-party SaaS provider. This proactive stance reduces the risk of non-compliance, builds trust, and satisfies the “accountability” principle in most privacy regulations (e.g., GDPR Art. 5(2), CCPA § 1798.100).Why the other choices are less appropriateOption A – Simply stating that “consumers must read the privacy policy” ignores the power imbalance and the need for transparent, proactive disclosure by the controller. Option C – While legal-requirement adherence is necessary, it is not sufficient; expecting privacy merely by following statutes overlooks the broader duty to manage expectations throughout the data lifecycle. Option D – Declaring that “commitment ends when data leaves New Company” contradicts the core privacy principle that controllers remain responsible for data protection wherever it is processed, including with downstream vendors.Key takeaway The correct approach is to actively manage stakeholder expectations for privacy in all contexts, even when the data is not yet owned or stored by New Company.
NIST Special Publication 800-53 Rev. 5 – Security and Privacy Controls for Information Systems and Organizations – Section PE-3 (Privacy Management) https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final International Association of Privacy Professionals (IAPP) – CIPP/US Body of Knowledge – Chapter 5 “Accountability & Governance” https://iapp.org/resources/cippus-body-of-knowledge/
SCENARIOTom looked forward to starting his new position with a U.S --based automobile leasing company (New Company), now operating in 32 states. New Company was recently formed through the merger of two prominent players, one from the eastern region (East Company) and one from the western region (West Company). Tom, a Certified Information Privacy Technologist (CIPT), is New Company's first Information Privacy and Security Officer. He met today with Dick from East Company, and Harry, from West Company. Dick and Harry are veteran senior information privacy and security professionals at their respective companies, and continue to lead the east and west divisions of New Company. The purpose of the meeting was to conduct a SWOT (strengths/weaknesses/opportunities/threats) analysis for New Company. Their SWOT analysis conclusions are summarized below.Dick was enthusiastic about an opportunity for the New Company to reduce costs and increase computing power and flexibility through cloud services. East Company had been contemplating moving to the cloud, but West Company already had a vendor that was providing it with software-as-a-service (SaaS). Dick was looking forward to extending this service to the eastern region. Harry noted that this was a threat as well, because West Company had to rely on the third party to protect its data.Tom mentioned that neither of the legacy companies had sufficient data storage space to meet the projected growth of New Company, which he saw as a weakness. Tom stated that one of the team's first projects would be to construct a consolidated New Company data warehouse. Tom would personally lead this project and would be held accountable if information was modified during transmission to or during storage in the new data warehouse.Tom, Dick and Harry agreed that employee network access could be considered both a strength and a weakness. East Company and West Company had strong performance records in this regard; both had robust network access controls that were working as designed. However, during a projected year-long transition period, New Company employees would need to be able to connect to a New Company network while retaining access to the East Company and West Company networks.When employees are working remotely, they usually connect to a Wi-Fi network. What should Harry advise for maintaining company security in this situation?
Answer(s): D
Why option D is the best choiceToken-based authentication (e.g., short-lived bearer tokens issued by an identity provider) is the only mechanism that can reliably verify a user’s identity without relying on static passwords that may be reused or intercepted. Tokens can be scoped to the corporate network, can be revoked instantly if compromised, and work across heterogeneous legacy networks, satisfying the requirement to access both East and West legacy systems while maintaining a unified security posture. Modern security standards (NIST 800-63B, OAuth 2.0, FIDO2) endorse token exchange over TLS-protected channels; even if the wording says “HTTP,” the intent is to use a token mechanism rather than plain-text passwords or obscurity-based methods.Why the other options are unsuitableHiding the SSID (A) – Provides only “security through obscurity”; it does not encrypt traffic nor authenticate users, and can be easily discovered with network sniffing tools. Retaining the existing network password (B) – Re-using legacy passwords does not address the transition period’s broader access-control challenges and does not mitigate the risk of credential leakage across multiple networks.Employing WEP encryption (C) – WEP is cryptographically weak, has known vulnerabilities, and is deprecated; it offers no real protection for modern wireless traffic and would actually weaken security posture.Conclusion – To preserve confidentiality and integrity while employees connect remotely, Harry should recommend implementing token-based authentication (option D), complemented by TLS-protected communication and centralized credential management.
NIST Special Publication 800-63B – Digital Identity Guidelines (Authentication, authentication tokens, and lifecycle management). https://csrc.nist.gov/publications/detail/sp/800-63b/final RFC 6750 – The OAuth 2.0 Token Binding Scheme (Guidance on using short-lived bearer tokens for authentication). https://tools.ietf.org/html/rfc6750 NIST Special Publication 800-41 Rev. 1 – Guide to Wireless Security (Recommendations on SSID broadcast, encryption, and network segmentation). https://csrc.nist.gov/publications/detail/sp/800-41/rev-1/final
SCENARIOLooking back at your first two years as the Director of Personal Information Protection and Compliance for the Berry Country Regional Medical Center in Thorn Bay, Ontario, Canada, you see a parade of accomplishments, from developing state-of-the-art simulation based training for employees on privacy protection to establishing an interactive medical records system that is accessible by patients as well as by the medical personnel. Now, however, a question you have put off looms large: how do we manage all the data-not only records produced recently, but those still on hand from years ago? A data flow diagram generated last year shows multiple servers, databases, and work stations, many of which hold files that have not yet been incorporated into the new records system. While most of this data is encrypted, its persistence may pose security and compliance concerns. The situation is further complicated by several long-term studies being conducted by the medical staff using patient information. Having recently reviewed the major Canadian privacy regulations, you want to make certain that the medical center is observing them.You also recall a recent visit to the Records Storage Section, often termed "The Dungeon" in the basement of the old hospital next to the modern facility, where you noticed a multitude of paper records. Some of these were in crates marked by years, medical condition or alphabetically by patient name, while others were in undifferentiated bundles on shelves and on the floor. The back shelves of the section housed data tapes and old hard drives that were often unlabeled but appeared to be years old. On your way out of the dungeon, you noticed just ahead of you a small man in a lab coat who you did not recognize. He carried a batch of folders under his arm, apparently records he had removed from storage.Which regulation most likely applies to the data stored by Berry Country Regional Medical Center?
Answer(s): A
Why option A (PIPEDA) is the best choiceJurisdiction – Canadian private-sector law : Berry Country Regional Medical Center operates in Ontario, Canada. The only listed regulation that is a Canadian statute governing personal information is the Personal Information Protection and Electronic Documents Act (PIPEDA). It applies to private-sector organizations that collect, use, or disclose personal information in the course of commercial activities, which includes a health-care provider that is not a governmental body.Scope of “personal health information” : PIPEDA defines health-related data as “personal information” and imposes specific obligations for its protection, including consent, limiting collection, limiting use, disclosure, and retention. The scenario describes both electronic and paper records, encrypted and unencrypted, stored on-site and off-site—precisely the types of data that PIPEDA requires to be handled with appropriate safeguards.Applicability to legacy and current data : PIPEDA’s “retention and disposal” provisions require that personal information not be kept longer than necessary and that reasonable safeguards be applied during transfer or archiving. This directly addresses the concerns about old paper files in “The Dungeon,” unlabeled data tapes, and legacy hard drives.Why the other options are unsuitableB: HIPAA – A United States federal law that governs “covered entities” and their business associates. It does not apply to a Canadian health-care facility and therefore cannot be invoked for compliance in Ontario. C. The Health Records Act 2001 – This is an Australian piece of legislation that regulates health-record privacy within Australia. It is irrelevant to a jurisdiction bound by Canadian privacy law. D. EU Directive 95/46/EC – The European Union’s data-protection directive (pre-GDPR) regulates personal data processing by EU-based controllers. While it shares similarities with PIPEDA, it does not have legal effect in Canada and does not govern a Canadian medical centre’s data practices.Conclusion : Among the four choices, only PIPEDA provides the legal framework that directly governs the handling of personal health information by a private health-care provider in Canada. It is therefore the regulation most likely to apply to Berry Country Regional Medical Center’s data-management challenges.
Personal Information Protection and Electronic Documents Act (PIPEDA) – Office of the Privacy Commissioner of Canada: https://www.priv.gc.ca/en/guidance_pips Canada’s Privacy Laws – Overview of PIPEDA and Provincial Legislation: https://www.priv.gc.ca/en/laws/pipe-dp-pipl (official Government of Canada site)
SCENARIOLooking back at your first two years as the Director of Personal Information Protection and Compliance for the Berry Country Regional Medical Center in Thorn Bay, Ontario, Canada, you see a parade of accomplishments, from developing state-of-the-art simulation based training for employees on privacy protection to establishing an interactive medical records system that is accessible by patients as well as by the medical personnel. Now, however, a question you have put off looms large: how do we manage all the data-not only records produced recently, but those still on hand from years ago? A data flow diagram generated last year shows multiple servers, databases, and work stations, many of which hold files that have not yet been incorporated into the new records system. While most of this data is encrypted, its persistence may pose security and compliance concerns. The situation is further complicated by several long-term studies being conducted by the medical staff using patient information. Having recently reviewed the major Canadian privacy regulations, you want to make certain that the medical center is observing them.You also recall a recent visit to the Records Storage Section, often termed "The Dungeon" in the basement of the old hospital next to the modern facility, where you noticed a multitude of paper records. Some of these were in crates marked by years, medical condition or alphabetically by patient name, while others were in undifferentiated bundles on shelves and on the floor. The back shelves of the section housed data tapes and old hard drives that were often unlabeled but appeared to be years old. On your way out of the dungeon, you noticed just ahead of you a small man in a lab coat who you did not recognize. He carried a batch of folders under his arm, apparently records he had removed from storage. Which data lifecycle phase needs the most attention at this Ontario medical center?
Why the Retention phase demands the most immediate focusThe scenario describes large volumes of legacy paper files, unlabeled tapes, and old hard-drives stored in the “Dungeon” – all still-active data that has outlived the original business need . Under Canadian privacy law (PHIPA) and the Office of the Privacy Commissioner (OPC) guidance , the retention period must be clearly defined, documented, and enforced so that personal health information (PHI) is not kept longer than necessary. Keeping PHI beyond its lawful retention period creates unauthorized disclosure risk (e.g., accidental exposure, unauthorized access by the unknown lab-coat figure) and can trigger breach-notification obligations if a security incident occurs. The other lifecycle stages are comparatively less critical in this context:Collection – the medical centre already has policies for acquiring PHI; the problem is not that data is being collected, but that it persists. Use – although data is used for research, the use itself is permissible if the data is retained lawfully; the core issue is whether the data should still be held. Disclosure – any disclosure from the legacy store must first meet the retention-policy requirement; otherwise the disclosure could be unlawful even if the data is later shared. Therefore, the most pressing phase is Retention : immediate actions must include inventory, classification, and destruction schedules to bring legacy holdings into compliance with PHIPA’s “minimum necessary” and “reasonable retention” rules.Recommended technical actions1. Conduct a data-inventory audit of all physical and digital repositories identified in the flow diagram. 2. Map each data set to its statutory retention period under PHIPA and any sector-specific regulations (e.g., Canada’s PIPEDA). 3. Implement secure de-identification or destruction procedures for data that has exceeded its retention window, ensuring proper chain-of-custody documentation. 4. Update the records-management policy to include automated retention-schedule enforcement (e.g., lifecycle policies on tape/ disk management systems). 5. Communicate the revised schedule to all staff, reinforcing that no PHI should remain accessible beyond its approved retention period .
Office of the Privacy Commissioner of Canada – “Retention and Disposal of Personal Information” https://www.priv.gc.ca/en/privacy-topics/retention-disposalOntario’s Personal Health Information Protection Act (PHIPA), 2004 – Retention provisions https://www.ontario.ca/laws/statute/04038These sources provide the legal framework and best-practice guidance for governing data-retention in Canadian health-care organizations.
SCENARIOLooking back at your first two years as the Director of Personal Information Protection and Compliance for the Berry Country Regional Medical Center in Thorn Bay, Ontario, Canada, you see a parade of accomplishments, from developing state-of-the-art simulation based training for employees on privacy protection to establishing an interactive medical records system that is accessible by patients as well as by the medical personnel. Now, however, a question you have put off looms large: how do we manage all the data-not only records produced recently, but those still on hand from years ago? A data flow diagram generated last year shows multiple servers, databases, and work stations, many of which hold files that have not yet been incorporated into the new records system. While most of this data is encrypted, its persistence may pose security and compliance concerns. The situation is further complicated by several long-term studies being conducted by the medical staff using patient information. Having recently reviewed the major Canadian privacy regulations, you want to make certain that the medical center is observing them.You also recall a recent visit to the Records Storage Section, often termed "The Dungeon" in the basement of the old hospital next to the modern facility, where you noticed a multitude of paper records. Some of these were in crates marked by years, medical condition or alphabetically by patient name, while others were in undifferentiated bundles on shelves and on the floor. The back shelves of the section housed data tapes and old hard drives that were often unlabeled but appeared to be years old. On your way out of the dungeon, you noticed just ahead of you a small man in a lab coat who you did not recognize. He carried a batch of folders under his arm, apparently records he had removed from storage.Which cryptographic standard would be most appropriate for protecting patient credit card information in the records system?
Why Symmetric Encryption (Option B) is the Best ChoiceBulk data protection – Credit-card numbers must be encrypted at rest and in transit across a large database; symmetric algorithms (e.g., AES-256) provide high-throughput, low-latency encryption suitable for encrypting entire records. Deterministic key management – A single secret key can protect many records efficiently; key rotation can be performed without re-encrypting all data if wrapped with a master key. PCI-DSS compliance – The Payment Card Industry Data Security Standard specifically requires strong cryptography (typically symmetric encryption) for stored cardholder data; asymmetric encryption is not recommended for bulk storage. Performance & scalability – Symmetric ciphers are computationally cheap compared with RSA/ECC, enabling the millions of records in a medical system to be protected without degrading system performance. Industry best practice – NIST SP 800-57 and PCI-DSS guidance both endorse symmetric encryption as the standard for protecting sensitive data such as credit-card numbers.Why the Other Options Are Less SuitableA: Asymmetric Encryption – Excellent for key exchange and digital signatures, but its high computational cost makes it impractical for encrypting large volumes of data at rest. C. Obfuscation – Provides no real security; it merely hides data and can be easily reversed, failing to meet regulatory encryption requirements. D. Hashing – One-way transformation that verifies integrity; it cannot be reversed to retrieve the original card number, making it unsuitable for protecting data that must be readable by authorized systems.Conclusion Symmetric encryption delivers the required confidentiality, performance, and regulatory compliance for safeguarding patient credit-card information within the new records system.
NIST Special Publication 800-57 Part 1 Rev. 5 – Recommendation for Key Management and Encryption Algorithms – https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final PCI Security Standards Council – PCI DSS Requirement 3.4 (Encrypt transmission of cardholder data across open, public networks) – https://www.pcisecuritystandards.org/document_library (search “PCI DSS Requirement 3.4”)
Post your Comments and Discuss IAPP CIPT exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CIPT content, but please register or login to continue.