SCENARIO
Please use the following to answer the next QUESTION:
As the Director of data protection for Consolidated Records Corporation, you are justifiably pleased with your accomplishments so far. Your hiring was precipitated by warnings from regulatory agencies following a series of relatively minor data breaches that could easily have been worse. However, you have not had a reportable incident for the three years that you have been with the company. In fact, you consider your program a model that others in the data storage industry may note in their own program development.
You started the program at Consolidated from a jumbled mix of policies and procedures and worked toward coherence across departments and throughout operations. You were aided along the way by the program's sponsor, the vice president of operations, as well as by a Privacy Team that started from a clear understanding of the need for change.
Initially, your work was greeted with little confidence or enthusiasm by the company's "old guard" among both the executive team and frontline personnel working with data and interfacing with clients. Through the use of metrics that showed the costs not only of the breaches that had occurred, but also projections of the costs that easily could occur given the current state of operations, you soon had the leaders and key decision-makers largely on your side. Many of the other employees were more resistant, but face-to-face meetings with each department and the development of a baseline privacy training program achieved sufficient "buy-in" to begin putting the proper procedures into place.
Now, privacy protection is an accepted component of all current operations involving personal or protected data and must be part of the end product of any process of technological development. While your approach is not systematic, it is fairly effective.
You are left contemplating:
What must be done to maintain the program and develop it beyond just a data breach prevention program?
How can you build on your success?
What are the next action steps?
What practice would afford the Director the most rigorous way to check on the program's compliance with laws, regulations and industry best practices?

• A. Auditing.
• B. Forensics.
• C. Monitoring.
• D. Assessment.

An organization can use Privacy-Enhancing Technologies (PETs) to?

• A. Strengthen existing privacy controls.
• B. Ensure compliance with local privacy regulations.
• C. Produce data for the privacy professional to interpret.
• D. Replace current technical controls.

You are the privacy officer at a university. Recently, the police have contacted you as they suspect that one of your students is using a library computer to commit financial fraud. The police would like your assistance in investigating this individual and are requesting computer logs and usage data of the student.
What Is your first step in responding to the request?

• A. Provide the data to police and record it for your own archives.
• B. Refuse the request as the police do not have a warrant.
• C. Review policies, procedures and legislation to determine the university's obligation to co-operate with the police.
• D. Contact the university's legal counsel to determine if the request is lawful.

Your marketing team wants to know why they need a check box for their SMS opt-in. You explain it is part of the consumer's right to?

• A. Request correction.
• B. Have access.
• C. Raise complaints.
• D. Be informed.