Discuss IAPP CIPP/A Exam Topic 1 Question 49

Which provision of Hong Kong's Personal Data (Privacy) Ordinance (PDPO) strengthens the purpose limitation principle (DPP3)?

ANotice; because the data subject must be provided with the purpose of the collection.

BPublic domain; because the data subjects must agree to the purpose before their information is made publicly available.

CPrescribed consent; because the data subject must give express consent to their personal information being used for additional purposes.

DFinality; because the purpose for collection of personal information from the subject must be directly related to a function of the collector.

Suggested Answer: A

Get Premium CIPP/A Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

18 comments · newest first

Magnolia 11 months ago

Not sure if D is the best choice, seems a bit vague to me.

Jamal 11 months ago

Wait, I didn’t know about the finality requirement! That’s interesting.

Jonell 12 months ago

A is important too, but it’s not the strongest for purpose limitation.

Natalya 12 months ago

I think C makes more sense, consent is crucial!

Mattie 1 year ago

D is the right answer! Finality is key for DPP3.

Marjory 1 year ago

I thought finality was key in ensuring the purpose is clear, so could it be D? I need to double-check my notes on this.

Alethea 1 year ago

I feel like notice is important too, but I can't recall if that directly relates to the purpose limitation principle.

Malcom 1 year ago

I remember something about consent being crucial, so maybe it's C? That sounds familiar from our practice questions.

Portia 1 year ago

I think DPP3 is about how data should only be used for the purpose it was collected for, but I'm not sure which option really emphasizes that.

Janella 1 year ago

Okay, I've reviewed the options a few times now. I'm leaning towards "prescribed consent" as the best answer, since that directly gives the data subject control over additional uses of their personal information.

Lawrence 1 year ago

I think the "finality" provision is the key here. The requirement that the purpose be directly related to the collector's function seems like a strong way to uphold the purpose limitation principle.

Leana 1 year ago

I'm a bit confused on the difference between "public domain" and "prescribed consent." I'll need to re-read those sections of the law to understand how they relate to the purpose limitation principle.

Leslie 1 year ago

The notice requirement makes sense to me as a way to strengthen the purpose limitation principle. If the data subject is informed of the purpose, that should help ensure the data is only used for that purpose.

Tamar 1 year ago

This seems like a tricky question. I'll need to carefully review the provisions of the PDPO to determine which one strengthens the purpose limitation principle.

Merri 1 year ago

Okay, the key detail here is that it's encrypting "one letter at a time." That points to a stream cipher, so I'm going to go with A.

Kerry 1 year ago

Hmm, I'm a bit unsure about this one. I'll need to review my notes on user research methods to make sure I pick the right option.

Brittney 1 year ago

Hmm, I'm a bit unsure about this one. The diagram seems simple enough, but I'm not sure which of these options is the best next step in refining the model.

Caprice 1 year ago

Okay, I've got it. Using third-party confirmations to support management's representations is a standard audit procedure, not an example of professional skepticism. The other options involve more critical thinking and challenging of management's assertions.

IAPP CIPP/A Exam - Topic 1 Question 49 Discussion