IAPP CIPP-US Certified Information Privacy Professional/United States (CIPP/US) Online Training

Question #51

Which of the following is an important implication of the Dodd-Frank Wall Street Reform and Consumer Protection Act?

A . Financial institutions must avoid collecting a customer’s sensitive personal information
B . Financial institutions must help ensure a customer’s understanding of products and services
C . Financial institutions must use a prescribed level of encryption for most types of customer records
D . Financial institutions must cease sending e-mails and other forms of advertising to customers who opt out of direct marketing

Question #52

Which act violates the Family Educational Rights and Privacy Act of 1974 (FERPA)?

A . A K-12 assessment vendor obtains a student’s signed essay about her hometown from her school to use as an exemplar for public release
B . A university posts a public student directory that includes names, hometowns, e-mail addresses,
and majors
C . A newspaper prints the names, grade levels, and hometowns of students who made the quarterly honor roll
D . University police provide an arrest report to a student’s hometown police, who suspect him of a similar crime

Correct Answer: A
A

Explanation:

The Family Educational Rights and Privacy Act of 1974 (FERPA) is a federal law that protects the privacy of student education records. FERPA grants parents or eligible students the right to access, amend, and control the disclosure of their education records, with some exceptions. Schools must obtain written consent from the parent or eligible student before disclosing any personally identifiable information from the education records, unless an exception applies123

Option A violates FERPA because it involves the disclosure of a student’s personally identifiable information (PII) from the education records without consent. A student’s signed essay about her hometown is considered an education record under FERPA, as it is directly related to the student and maintained by the school12 A K-12 assessment vendor is not a school official with a legitimate educational interest, nor does it fall under any of the exceptions that allow disclosure without consent12 Therefore, the school must obtain the student’s (or the parent’s, if the student is a minor) written consent before providing the essay to the vendor for public release.

Option B does not violate FERPA because it involves the disclosure of directory information, which is not considered PII under FERPA. Directory information is information that would not generally be considered harmful or an invasion of privacy if disclosed, such as name, address, phone number, e-mail address, major, etc12 Schools may disclose directory information without consent, unless the parent or eligible student has opted out of such disclosure12 However, schools must notify parents and eligible students of the types of directory information they designate and their right to opt out annually12

Option C does not violate FERPA because it involves the disclosure of information that is not part of the education records. FERPA only applies to education records that are directly related to a student and maintained by the school or a party acting for the school12 A newspaper’s publication of the names, grade levels, and hometowns of students who made the quarterly honor roll is not based on the education records, but on the newspaper’s own sources and reporting. Therefore, FERPA does not prohibit such disclosure.

Option D does not violate FERPA because it involves the disclosure of information under an exception that allows disclosure without consent. FERPA permits schools to disclose education records, or PII from education records, without consent to comply with a judicial order or lawfully issued subpoena, or to appropriate officials in connection with a health or safety emergency123 If the university police provide an arrest report to the student’s hometown police in response to a subpoena or to prevent a serious threat to the student or others, they are not violating FERPA.

Reference: 1: Family Educational Rights and Privacy Act – Wikipedia 2: Family Educational Rights and

Privacy Act (FERPA) | CDC 3: What is FERPA? | Protecting Student Privacy – ed

Question #53

According to FERPA, when can a school disclose records without a student’s consent?

A . If the disclosure is not to be conducted through email to the third party
B . If the disclosure would not reveal a student’s student identification number
C . If the disclosure is to practitioners who are involved in a student’s health care
D . If the disclosure is to provide transcripts to a school where a student intends to enroll

Reveal Solution Hide Solution

Question #53

According to FERPA, when can a school disclose records without a student’s consent?

A . If the disclosure is not to be conducted through email to the third party
B . If the disclosure would not reveal a student’s student identification number
C . If the disclosure is to practitioners who are involved in a student’s health care
D . If the disclosure is to provide transcripts to a school where a student intends to enroll

Reveal Solution Hide Solution

Question #55

What is the main purpose of the CAN-SPAM Act?

A . To diminish the use of electronic messages to send sexually explicit materials
B . To authorize the states to enforce federal privacy laws for electronic marketing
C . To empower the FTC to create rules for messages containing sexually explicit content
D . To ensure that organizations respect individual rights when using electronic advertising

Reveal Solution Hide Solution

Question #56

The Video Privacy Protection Act of 1988 restricted which of the following?

A . Which purchase records of audio visual materials may be disclosed
B . When downloading of copyrighted audio visual materials is allowed
C . When a user’s viewing of online video content can be monitored
D . Who advertisements for videos and video games may target

Reveal Solution Hide Solution

Question #57

The Cable Communications Policy Act of 1984 requires which activity?

A . Delivery of an annual notice detailing how subscriber information is to be used
B . Destruction of personal information a maximum of six months after it is no longer needed
C . Notice to subscribers of any investigation involving unauthorized reception of cable services
D . Obtaining subscriber consent for disseminating any personal information necessary to render cable services

Reveal Solution Hide Solution

Question #58

What is the main purpose of requiring marketers to use the Wireless Domain Registry?

A . To access a current list of wireless domain names
B . To prevent unauthorized emails to mobile devices
C . To acquire authorization to send emails to mobile devices
D . To ensure their emails are sent to actual wireless subscribers

Reveal Solution Hide Solution

Question #58

What is the main purpose of requiring marketers to use the Wireless Domain Registry?

A . To access a current list of wireless domain names
B . To prevent unauthorized emails to mobile devices
C . To acquire authorization to send emails to mobile devices
D . To ensure their emails are sent to actual wireless subscribers

Reveal Solution Hide Solution

Question #58

What is the main purpose of requiring marketers to use the Wireless Domain Registry?

A . To access a current list of wireless domain names
B . To prevent unauthorized emails to mobile devices
C . To acquire authorization to send emails to mobile devices
D . To ensure their emails are sent to actual wireless subscribers

Reveal Solution Hide Solution