An organization based in California, USA is implementing a new online helpdesk solution for recording customer call information. The organization considers the capture of personal data on the online helpdesk solution to be in the interest of the company in best servicing customer calls.

Before implementation, a privacy technologist should conduct which of the following?

A. A Data Protection Impact Assessment (DPIA) and consultation with the appropriate regulator to ensure legal compliance.

B. A privacy risk and impact assessment to evaluate potential risks from the proposed processing operations.

C. A Legitimate Interest Assessment (LIA) to ensure that the processing is proportionate and does not override the privacy, rights and freedoms of the customers.

D. A security assessment of the help desk solution and provider to assess if the technology was developed with a security by design approach.

SCENARIO

You have just been hired by Ancillary.com, a seller of accessories for everything under the sun, including waterproof stickers for pool floats and decorative bands and cases for sunglasses. The company sells cell phone cases, e-cigarette

cases, wine spouts, hanging air fresheners for homes and automobiles, book ends, kitchen implements, visors and shields for computer screens, passport holders, gardening tools and lawn ornaments, and catalogs full of health and beauty

products. The list seems endless. As the CEO likes to say, Ancillary offers, without doubt, the widest assortment of low-price consumer products from a single company anywhere.

Ancillary's operations are similarly diverse. The company originated with a team of sales consultants selling home and beauty products at small parties in the homes of customers, and this base business is still thriving. However, the company

now sells online through retail sites designated for industries and demographics, sites such as "My Cool Ride" for automobile-related products or "Zoomer" for gear aimed toward young adults. The company organization includes a plethora of

divisions, units and outrigger operations, as Ancillary has been built along a decentered model rewarding individual initiative and flexibility, while also acquiring key assets. The retail sites seem to all function differently, and you wonder about

their compliance with regulations and industry standards. Providing tech support to these sites is also a challenge, partly due to a variety of logins and authentication protocols.

You have been asked to lead three important new projects at Ancillary:

The first is the personal data management and security component of a multi-faceted initiative to unify the company's culture. For this project, you are considering using a series of third- party servers to provide company data and approved

applications to employees.

The second project involves providing point of sales technology for the home sales force, allowing them to move beyond paper checks and manual credit card imprinting.

Finally, you are charged with developing privacy protections for a single web store housing all the company's product lines as well as products from affiliates. This new omnibus site will be known, aptly, as "Under the Sun." The Director of

Marketing wants the site not only to sell Ancillary's products, but to link to additional products from other retailers through paid advertisements. You need to brief the executive team of security concerns posed by this approach.

What technology is under consideration in the first project in this scenario?

A. Server driven controls.

B. Cloud computing

C. Data on demand

D. MAC filtering

When writing security policies, the most important consideration is to?

A. Require all employees to read and acknowledge their understanding.

B. Ensure they are based on the organization's risk profile.

C. Ensure they cover enough details for common situations.

D. Follow industry best practices.

SCENARIO

Clean-Q is a company that offers house-hold and office cleaning services. The company receives requests from consumers via their website and telephone, to book cleaning services. Based on the type and size of service, Clean-Q then contracts individuals that are registered on its resource database - currently managed in-house by Clean-Q IT Support. Because of Clean-Q's business model, resources are contracted as needed instead of permanently employed. The table below indicates some of the personal information Clean-Q requires as part of its business operations:

Clean-Q has an internal employee base of about 30 people. A recent privacy compliance exercise has been conducted to align employee data management and human resource functions with applicable data protection regulation. Therefore,

the Clean-Q permanent employee base is not included as part of this scenario.

With an increase in construction work and housing developments, Clean-Q has had an influx of requests for cleaning services. The demand has overwhelmed Clean-Q's traditional supply and demand system that has caused some

overlapping bookings.

Ina business strategy session held by senior management recently, Clear-Q invited vendors to present potential solutions to their current operational issues. These vendors included Application developers and Cloud-Q's solution providers,

presenting their proposed solutions and platforms.

The Managing Director opted to initiate the process to integrate Clean-Q's operations with a cloud solution (LeadOps) that will provide the following solution one single online platform: A web interface that Clean-Q accesses for the purposes

of resource and customer management. This would entail uploading resource and customer information.

A customer facing web interface that enables customers to register, manage and submit cleaning service requests online.

A resource facing web interface that enables resources to apply and manage their assigned jobs.

An online payment facility for customers to pay for services.

What is a key consideration for assessing external service providers like LeadOps, which will conduct personal information processing operations on Clean-Q's behalf?

A. Understanding LeadOps' costing model.

B. Establishing a relationship with the Managing Director of LeadOps.

C. Recognizing the value of LeadOps' website holding a verified security certificate.

D. Obtaining knowledge of LeadOps' information handling practices and information security environment.

Granting data subjects the right to have data corrected, amended, or deleted describes?

A. Use limitation.

B. Accountability.

C. A security safeguard

D. Individual participation

Combining multiple pieces of information about an individual to produce a whole that is greater than the sum of its parts is called?

A. Identification.

B. Insecurity.

C. Aggregation.

D. Exclusion.

A computer user navigates to a page on the Internet. The privacy notice pops up and the user clicks the box to accept cookies, then continues to scroll the page to read the Information displayed. This is an example of which type of consent?

A. Explicit.

B. Implicit.

C. Specific

D. Valid.

What occurs during data distortion?

A. False and inaccurate information about an individual is shared

B. Data collected about an individual includes prejudicial assumptions

C. The personal data about an individual is modified to preserve their anonymity

D. Truthful information that negatively affects how others view an individual is revealed

Failing to update software for a system that processes human resources data with the latest security patches may create what?

A. Data breaches.

B. Discrimination risks.

C. Privacy vulnerabilities

D. Increased threat sources

One-way hash functions can be used is to?

A. Verify a password in a secure way.

B. Recover a credit card number at refund

C. Encrypt a document for confidentiality.

D. Secure an end-to-end communication.