Limits on Private-sector Collection and Use of Data
Free Certified Information Privacy Professional/United States practice — 6 questions on Limits on Private-sector Collection and Use of Data, with explanations. No sign-up. Full 12-question mixed test →
An employer orders a consumer report (background check) on a job applicant through a consumer reporting agency and, based on negative information in the report, decides not to hire the applicant. Under the FCRA, what must the employer do before making this decision final?
The FCRA requires a two-step adverse action process for employment decisions: a pre-adverse action notice (copy of the report plus the Summary of Your Rights Under the FCRA) followed by a reasonable waiting period before sending the final adverse action notice, giving the applicant time to dispute inaccuracies.
Under the FTC's amended GLBA Safeguards Rule, a financial institution wants to allow employees to access customer information systems remotely. Which control does the Rule specifically require to authenticate individuals accessing these systems, unless the Qualified Individual approves a reasonably equivalent alternative?
The amended Safeguards Rule (16 CFR 314.4(c)(5)) requires financial institutions to implement multi-factor authentication for any individual accessing customer information systems, unless the Qualified Individual approves reasonably equivalent alternative controls in writing.
A hospital contracts with a third-party billing company to process insurance claims on its behalf, which requires the billing company to access patient PHI. What must be in place under HIPAA before PHI is shared with the billing company?
The billing company is a business associate performing a function involving PHI on the covered entity's behalf. HIPAA requires a Business Associate Agreement (45 CFR 164.502(e), 164.504(e)) establishing permitted uses, safeguards, and breach obligations before PHI is disclosed.
A retailer wants to send autodialed marketing text messages advertising a new product line to consumers' personal cell phones. What level of consent must the retailer obtain from consumers under the TCPA before sending these messages?
FCC rules under the TCPA require prior express written consent for autodialed or prerecorded marketing calls and texts to wireless numbers, including a clear disclosure that consent is not a condition of purchase.
Which standard determines whether a general audience website operator (one not directed to children) is subject to COPPA's requirements with respect to a specific user?
COPPA applies to general audience website operators only when they have actual knowledge that a particular user is a child under 13; child-directed sites, by contrast, are covered regardless of actual knowledge of any individual user's age.
A university wants to share student education records with an outside vendor providing academic advising software, without obtaining prior written consent from each student. Under FERPA's school official exception, which condition must be satisfied?
FERPA's school official exception (34 CFR 99.31(a)(1)) permits disclosure without consent to contractors and vendors performing institutional services, provided the university maintains direct control over the vendor's use and maintenance of the records, the vendor has a legitimate educational interest, and use is limited to the authorized purpose.
Ready for the real thing?
The full course has two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed answer explanations.
Start my full course on Udemy →