New Year Sale 2026! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions

IAPP CIPM Exam - Topic 3 Question 67 Discussion

Actual exam question for IAPP's CIPM exam
Question #: 67
Topic #: 3
[All CIPM Questions]

SCENARIO

Please use the following to answer the next QUESTION:

Manasa is a product manager at Omnipresent Omnimedia, where she is responsible for leading the development of the company's flagship product, the Handy Helper. The Handy Helper is an application that can be used in the home to manage family calendars, do online shopping, and schedule doctor appointments. After having had a successful launch in the United States, the Handy Helper is about to be made available for purchase worldwide.

The packaging and user guide for the Handy Helper indicate that it is a "privacy friendly" product suitable for the whole family, including children, but does not provide any further detail or privacy notice. In order to use the application, a family creates a single account, and the primary user has access to all information about the other users. Upon start up, the primary user must check a box consenting to receive marketing emails from Omnipresent Omnimedia and selected marketing partners in order to be able to use the application.

Sanjay, the head of privacy at Omnipresent Omnimedia, was working on an agreement with a European distributor of Handy Helper when he fielded many Questions about the product from the distributor. Sanjay needed to look more closely at the product in order to be able to answer the Questions as he was not involved in the product development process.

In speaking with the product team, he learned that the Handy Helper collected and stored all of a user's sensitive medical information for the medical appointment scheduler. In fact, all of the user's information is stored by Handy Helper for the additional purpose of creating additional products and to analyze usage of the product. This data is all stored in the cloud and is encrypted both during transmission and at rest.

Consistent with the CEO's philosophy that great new product ideas can come from anyone, all Omnipresent Omnimedia employees have access to user data under a program called Eurek

a. Omnipresent Omnimedia is hoping that at some point in the future, the data will reveal insights that could be used to create a fully automated application that runs on artificial intelligence, but as of yet, Eureka is not well-defined and is considered a long-term goal.

What step in the system development process did Manasa skip?

Show Suggested Answer Hide Answer
Suggested Answer: A

A physical control that can limit privacy risk is keypad or biometric access. This is a type of access control that restricts who can enter or access a physical location or device where personal data is stored or processed. Keypad or biometric access requires a code or a biological feature (such as a fingerprint or a face scan) to authenticate the identity and authorization of the person seeking access. This can prevent unauthorized access, theft, loss, or damage of personal data by outsiders or insiders, .Reference:[CIPM - International Association of Privacy Professionals], [Free CIPM Study Guide - International Association of Privacy Professionals]


Contribute your Thoughts:

0/2000 characters
Jose
3 months ago
Consent for marketing emails should be clearer, for sure!
upvoted 0 times
...
Marci
4 months ago
I think they skipped the EU Privacy Shield check too.
upvoted 0 times
...
Rory
4 months ago
Wait, they don't have a clear privacy notice? That's surprising!
upvoted 0 times
...
Naomi
4 months ago
Totally agree, they should've worked with Sanjay first!
upvoted 0 times
...
Carry
4 months ago
Handy Helper collects sensitive medical info? That's a big deal!
upvoted 0 times
...
Rikki
5 months ago
I wonder if the AI feature could have been built earlier to avoid collecting sensitive info. But I think the main issue is about privacy compliance, right?
upvoted 0 times
...
Gerald
5 months ago
This scenario reminds me of a practice question about data protection regulations. I think the right answer is related to reviewing privacy requirements with Sanjay.
upvoted 0 times
...
Nichelle
5 months ago
I'm not entirely sure, but I feel like obtaining express written consent for marketing is crucial. Maybe that’s what she missed?
upvoted 0 times
...
Breana
5 months ago
I remember we discussed the importance of privacy requirements in product development. I think Manasa might have skipped working with Sanjay on that.
upvoted 0 times
...
Harris
5 months ago
Whoa, this is a lot to unpack. The fact that all employees have access to user data under this "Eureka" program is really concerning from a privacy standpoint. I think Manasa really dropped the ball by not addressing that and other privacy issues upfront. This could end up being a big problem down the line.
upvoted 0 times
...
Micaela
5 months ago
Okay, let me think this through. Based on the details provided, it seems like Manasa should have obtained explicit user consent for things like data collection and marketing, rather than just having a checkbox. And she probably should have certified compliance with privacy frameworks like EU-US Privacy Shield. This is a good lesson on the importance of privacy by design.
upvoted 0 times
...
Myra
5 months ago
Hmm, this is a complex scenario. I think the key issue is that Manasa didn't work with the privacy team to ensure the product met all the necessary privacy requirements, especially for international distribution. That seems like a big oversight.
upvoted 0 times
...
Gearldine
5 months ago
This is a tricky one. I'm not sure if I fully understand all the privacy implications here, but it seems like Manasa may have skipped some important steps in considering user privacy and consent.
upvoted 0 times
...
Tricia
5 months ago
I'm leaning towards option B because it aligns with what I learned about separating the application layer from the database layer in three-tier architecture.
upvoted 0 times
...
Dortha
10 months ago
I wonder if the Handy Helper can schedule a doctor's appointment to treat the privacy headache Manasa is about to cause the company. Yikes!
upvoted 0 times
...
Dyan
10 months ago
I bet the Eureka program was named by the same person who thought 'privacy friendly' was an appropriate descriptor for this product. Manasa clearly needs a refresher on privacy best practices.
upvoted 0 times
...
Janine
10 months ago
Consent for marketing emails? That's the least of their worries. Collecting sensitive health data without proper privacy measures is a huge no-no. Manasa must have skipped the 'common sense' step in the development process.
upvoted 0 times
Reta
8 months ago
Building the artificial intelligence feature to avoid inputting sensitive information is important for user privacy.
upvoted 0 times
...
Lezlie
8 months ago
Certifying that the Handy Helper meets the requirements of the EU-US Privacy Shield Framework is crucial.
upvoted 0 times
...
Kasandra
9 months ago
Sanjay should have reviewed necessary privacy requirements to be built into the product.
upvoted 0 times
...
Fabiola
9 months ago
Manasa should have obtained express written consent from users regarding marketing.
upvoted 0 times
...
...
Renea
10 months ago
The Eureka program is a disaster waiting to happen. All employees having access to user data? That's a recipe for disaster. Manasa really dropped the ball on this one.
upvoted 0 times
Malika
9 months ago
The Eureka program is definitely a concern. All employees having access to user data is risky.
upvoted 0 times
...
Tammi
9 months ago
Sanjay should have worked with Manasa to review necessary privacy requirements for the product.
upvoted 0 times
...
Melvin
9 months ago
Manasa should have obtained express written consent from users regarding marketing.
upvoted 0 times
...
...
Edelmira
11 months ago
Wait, they're storing all our sensitive medical data? This seems like a major privacy violation. Shouldn't Manasa have worked with the privacy team to ensure proper data handling?
upvoted 0 times
Zita
10 months ago
Yes, obtaining express written consent from users regarding marketing was a step that was skipped.
upvoted 0 times
...
Elke
10 months ago
Manasa should have worked with the privacy team to ensure proper data handling.
upvoted 0 times
...
...
Arlen
11 months ago
But shouldn't she also have worked with Sanjay to review privacy requirements?
upvoted 0 times
...
Berry
11 months ago
I agree with Lucy. It's important to get user consent for marketing.
upvoted 0 times
...
Lucy
11 months ago
I think Manasa skipped obtaining consent from users for marketing emails.
upvoted 0 times
...

Save Cancel