IAPP CIPP/A Exam - Topic 3 Question 81 Discussion

Actual exam question for IAPP's CIPP/A exam

Question #: 81
Topic #: 3

SCENARIO -- Please use the following to answer the next QUESTION:

B-Star Limited is a Singapore based construction company with many foreign construction workers. B-Star's HR team maintains two databases. One (the "simple database") contains basic details from a standard in- processing form such as name, local address and mobile number. The other database (the "sensitive database") contains information collected by the HR Department as part of Annual Review Interviews. With the workers' cooperation, this database has expanded to include far-reaching sensitive information such as medical history, religious beliefs, ethnicity and educational levels of immediate family members. Carl left B- Star's employment yesterday, and has flown back home, rendering him unreachable. Today B-Star, without Carl's consent, wants to conduct research using Carl's medical records in the sensitive database.

Can B-Star legally conduct this research using Carl's medical data?

AYes, because Carl gave his consent for his sensitive personal data to be collected during his employment.

BNo, an organization is not allowed to use sensitive personal data without an individual's consent unless absolutely necessary.

CNo, because the research is taking place after Carl has left B-Star's employment.

DYes, if the research is deemed to be in the public interest.

Show Suggested Answer

Suggested Answer: B

by Sharan at Jun 12, 2025, 11:43 AM

Limited Time Offer

25%

Off

Get Premium CIPP/A Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Jame

3 months ago

No way, that sounds illegal to me.

upvoted 0 times

...

Annamaria

3 months ago

Totally agree, that's a violation of privacy!

upvoted 0 times

...

Dewitt

3 months ago

Wait, can they really do that after he left?

upvoted 0 times

...

Nidia

3 months ago

I thought consent was only for the time of employment.

upvoted 0 times

...

Tora

4 months ago

They can't use his data without consent, right?

upvoted 0 times

...

Willodean

4 months ago

I recall that sensitive data has stricter rules, so I lean towards option C since Carl is no longer employed.

upvoted 0 times

...

Quentin

4 months ago

This reminds me of a practice question about data protection laws. I think the answer is B, but I could be wrong about the specifics.

upvoted 0 times

...

Eura

4 months ago

I'm not entirely sure, but I feel like using medical records without consent is a big no-no, even if they collected it before.

upvoted 0 times

...

Ashlyn

5 months ago

I remember discussing consent in class, and I think sensitive data needs explicit consent, especially after employment ends.

upvoted 0 times

...

Stephaine

5 months ago

Okay, let me break this down. The key points are that Carl's sensitive personal data was collected with his cooperation, but he's no longer an employee. So even though he gave consent before, I don't think that covers using the data for research after he's left the company. I'm leaning towards option B or C.

upvoted 0 times

...

Lezlie

5 months ago

I think the answer is pretty clear - B-Star cannot use Carl's medical data for research without his consent, especially since he's no longer an employee. The fact that the data is in a "sensitive database" suggests it's protected information that requires explicit permission to access.

upvoted 0 times

...

Annelle

5 months ago

Hmm, I'm a bit unsure about this one. The question mentions that Carl gave consent for his sensitive data to be collected, but it's not clear if that consent extends to using the data for research after he's left the company. I'll need to think through the details carefully.

upvoted 0 times

...

Shizue

5 months ago

This scenario seems pretty straightforward to me. The key is that Carl's consent is required for his sensitive personal data to be used, and he has already left the company, so I don't think they can legally conduct the research without his consent.

upvoted 0 times

...

Angelo

8 months ago

But what if the research is really important for public interest?

upvoted 0 times

...

Arlie

8 months ago

I bet Carl's medical records include a diagnosis of 'chronic case of the Mondays'. That's the real sensitive data here.

upvoted 0 times

Fernanda

7 months ago

C) No, because the research is taking place after Carl has left B-Star's employment.

upvoted 0 times

...

Xuan

7 months ago

B) No, an organization is not allowed to use sensitive personal data without an individual's consent unless absolutely necessary.

upvoted 0 times

...

Joni

8 months ago

A) Yes, because Carl gave his consent for his sensitive personal data to be collected during his employment.

upvoted 0 times

...

Bettina

8 months ago

I'm a bit confused. Isn't 'sensitive data' kind of a given in a 'sensitive database'? Talk about stating the obvious.

upvoted 0 times

Salena

7 months ago

C) No, because the research is taking place after Carl has left B-Star's employment.

upvoted 0 times

...

Roselle

7 months ago

B) No, an organization is not allowed to use sensitive personal data without an individual's consent unless absolutely necessary.

upvoted 0 times

...

Alesia

8 months ago

A) Yes, because Carl gave his consent for his sensitive personal data to be collected during his employment.

upvoted 0 times

...

Gerry

8 months ago

I agree with you, Gerry. It's important to respect individuals' privacy rights.

upvoted 0 times

...

Jina

9 months ago

I'm going with D. If the research is for the public good, they should be able to use the data, right? Who cares about Carl's consent at this point?

upvoted 0 times

...

Devora

9 months ago

Definitely C. Once Carl left the company, they can't use his data without his permission.

upvoted 0 times

...

An

9 months ago

I think the answer is B. They can't use Carl's sensitive data without his consent, even if it's for research.

upvoted 0 times

Tomoko

7 months ago

D) Yes, if the research is deemed to be in the public interest.

upvoted 0 times

...

Elise

7 months ago

C) No, because the research is taking place after Carl has left B-Star's employment.

upvoted 0 times

...

Angelo

7 months ago

B) No, an organization is not allowed to use sensitive personal data without an individual's consent unless absolutely necessary.

upvoted 0 times

...

Brittney

8 months ago

C) No, because the research is taking place after Carl has left B-Star's employment.

upvoted 0 times

...

Carylon

8 months ago

B) No, an organization is not allowed to use sensitive personal data without an individual's consent unless absolutely necessary.

upvoted 0 times

...

Fletcher

9 months ago

A) Yes, because Carl gave his consent for his sensitive personal data to be collected during his employment.

upvoted 0 times

...

Ellsworth

9 months ago

A) Yes, because Carl gave his consent for his sensitive personal data to be collected during his employment.

upvoted 0 times

...

Leota

9 months ago

I think B-Star should not use Carl's medical data without his consent.

upvoted 0 times

...