Changed CDPSE Exam Questions

The data protection principle that is applied when an online business posts its customer data protection notice that includes a statement indicating information is collected on how products are used, the content viewed, and the time and duration of online activities is lawfulness and fairness. Lawfulness and fairness are two of the core principles of data protection under various laws and regulations, such as the GDPR or the CCPA. They state that personal data should be processed lawfully, fairly and in a transparent manner in relation to the data subject. By posting a customer data protection notice that informs customers about what information is collected and for what purpose, the online business demonstrates its compliance with these principles.

System use requirements, data integrity and confidentiality, or data use limitation are not the correct names of the data protection principles that are applied in this case. System use requirements are not a specific principle of data protection, but rather a general term that refers to the rules or policies that govern how users can access and use a system or service. Data integrity and confidentiality are two aspects of the security principle of data protection, which states that personal data should be processed in a manner that ensures appropriate security of the personal data. Data use limitation is not a specific principle of data protection either, but rather a concept that relates to the purpose limitation principle, which states that personal data should be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.

Risk transfer means shifting financial liability or impact to another party. Cyber insurance (B) directly achieves this by covering breach-related costs. Adopting standards (A) and retaining third parties (C, D) are risk mitigation/reduction, not transfer.

“Risk transfer is commonly achieved via insurance coverage for breach costs and liabilities.”

Conducting a privacy impact assessment (PIA) should be done first to establish privacy by design when developing a contact-tracing application. A PIA is a systematic process that identifies and evaluates the potential effects of personal data processing operations on the privacy of individuals and the organization. A PIA helps to identify privacy risks and mitigation strategies at an early stage of development and ensures compliance with legal and regulatory requirements. Conducting a development environment review, identifying privacy controls, or identifying differential privacy techniques are important steps in privacy by design, but they should be done after conducting a PIA. References: CDPSE Exam Content Outline, Domain 2, Task 2.1

The best approach for handling personal data that has been restricted is to flag users’ email addresses to make sure they do not receive promotional information, because this will respect the users’ preferences and rights to opt out of marketing communications. This will also help the company comply with the data protection laws and regulations that require consent and transparency for sending marketing emails, such as the General Data Protection Regulation (GDPR) and the CAN-SPAM Act12. The other options are not appropriate or sufficient for handling restricted data, because they may violate the users’ rights, expectations, or agreements, or cause operational issues for the company.