Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions

IAPP Exam CIPM Topic 6 Question 51 Discussion

Actual exam question for IAPP's CIPM exam
Question #: 51
Topic #: 6
[All CIPM Questions]

SCENARIO

Please use the following to answer the next QUESTION:

Your organization, the Chicago (U.S.)-based Society for Urban Greenspace, has used the same vendor to operate all aspects of an online store for several years. As a small nonprofit, the Society cannot afford the higher-priced options, but you have been relatively satisfied with this budget vendor, Shopping Cart Saver (SCS). Yes, there have been some issues. Twice, people who purchased items from the store have had their credit card information used fraudulently subsequent to transactions on your site, but in neither case did the investigation reveal with certainty that the Society's store had been hacked. The thefts could have been employee-related.

Just as disconcerting was an incident where the organization discovered that SCS had sold information it had collected from customers to third parties. However, as Jason Roland, your SCS account representative, points out, it took only a phone call from you to clarify expectations and the ''misunderstanding'' has not occurred again.

As an information-technology program manager with the Society, the role of the privacy professional is only one of many you play. In all matters, however, you must consider the financial bottom line. While these problems with privacy protection have been significant, the additional revenues of sales of items such as shirts and coffee cups from the store have been significant. The Society's operating budget is slim, and all sources of revenue are essential.

Now a new challenge has arisen. Jason called to say that starting in two weeks, the customer data from the store would now be stored on a data cloud. ''The good news,'' he says, ''is that we have found a low-cost provider in Finland, where the data would also be held. So, while there may be a small charge to pass through to you, it won't be exorbitant, especially considering the advantages of a cloud.''

Lately, you have been hearing about cloud computing and you know it's fast becoming the new paradigm for various applications. However, you have heard mixed reviews about the potential impacts on privacy protection. You begin to research and discover that a number of the leading cloud service providers have signed a letter of intent to work together on shared conventions and technologies for privacy protection. You make a note to find out if Jason's Finnish provider is signing on.

What is the best way to prevent the Finnish vendor from transferring data to another party?

Show Suggested Answer Hide Answer
Suggested Answer: B

The first stage in the incident response plan under the General Data Protection Regulation (GDPR) for this scenario would be to contain the impact of the breach. This means taking immediate action to stop the unauthorized access or disclosure of personal data, and to prevent it from happening again in the future. This could involve revoking access to the data, notifying the employee who mistakenly sent the data, and implementing security measures to prevent similar breaches from occurring in the future.


https://gdpr-info.eu/art-33-gdpr/

https://gdpr-info.eu/art-34-gdpr/

Contribute your Thoughts:

Harley
2 days ago
Locking the data down in its current location seems a bit extreme. I'd rather try to work with the vendor and include contractual provisions to protect the data.
upvoted 0 times
...
Millie
5 days ago
I think the best way would be to include transfer prohibitions in the vendor contract. That way, there's a legal agreement in place to prevent the data from being transferred elsewhere.
upvoted 0 times
...
Angelica
7 days ago
I'm not sure, maybe we should also consider option A, restricting the vendor to using company security controls.
upvoted 0 times
...
Renea
8 days ago
I agree with Paulina, that seems like the best way to prevent data transfer to another party.
upvoted 0 times
...
Paulina
12 days ago
I think we should go with option C, include transfer prohibitions in the vendor contract.
upvoted 0 times
...

Save Cancel
az-700  pass4success  az-104  200-301  200-201  cissp  350-401  350-201  350-501  350-601  350-801  350-901  az-720  az-305  pl-300  

Warning: Cannot modify header information - headers already sent by (output started at /pass.php:70) in /pass.php on line 77