DSCI DCPP-01 問題集

質問 1：
A financial organization may share nonpublic information about its customers in accordance with Gramm-Leach-Bliley Act of the US. Which one of the following is the requirement?
A. Data sharing does not require consent from the consumers.
B. As soon as the GLBA privacy notice is disclosed initially and annually
C. FTC permission is required
D. Consumers' consent must be obtained first
正解：D

質問 2：
After the rules were notified under section 43A of the IT (Amendment) Act, 2008, a clarification was issued by the government which exempted the service providers, which get access to/processes Sensitive Personal Data or information (SPDI) under contractual agreement with a legal entity located within or outside Indi a. Which privacy principle provisions notified under Sec 43A were exempted for the service providers?
A. Access and Correction
B. Privacy policy (which is published)
C. Consent
D. Disclosure of information
正解：C

質問 3：
A multinational company with operations in several parts within EU and outside EU, involves international data transfer of both its employees and customers. In some of its EU branches, which are relatively larger in size, the organization has a works council. Most of the data transferred is personal, and some of the data that the organization collects is sensitive in nature, the processing of some of which is also outsourced to its branches in Asian countries.
For the outsourced work of its customers' data processing, in order to initiate data transfer to another organizations outside EU, which is the most appropriate among the following?
A. Since the data is processed by the vendor outside the EU, the EU directive does not apply and hence there are no legal concerns
B. The data exporter needs to initiate model contractual clauses after obtaining approvals from data protection commissioner and have the vendor be a signatory on the same as data importer
C. The vendor (data importer) in the third country, and not the exporter is responsible to put in place suitable model contractual clauses, and hence the exporter does not need to take any action.
D. The data importer need to notify about the transfer to data protection commissioner in the destination country and exporter need to similarly notify in the EU country of origin
正解：D

質問 4：
In relation to "Online Privacy" please pick the incorrect statement:
A. People's concern over the way their personal information is used during online activities
B. People's concerns over the license agreements they sign with any company
C. Online disclosure of "selective" information by a person that is publicly available
D. The process of obtaining information online that a person can control
正解：D

質問 5：
Which of the following laid foundation for the development of OECD privacy principles for the promotion of free international trade and trans border data flows?
A. Fair information Privacy Practices of US, 1974
B. WTO's Free Trade Agreement
C. Safe Harbor Framework
D. EU Data Protection Directive
正解：D

質問 6：
Which of the following provides the legal basis for an Adjudicating Officer in every Indian state & union territory, with the powers of a civil court, to hear complaints and order compensation to the affected individuals?
A. Telecom Regulatory Authority of India (TRAI) Act
B. Indian Civil Code
C. Indian Criminal Procedure Code
D. Information Technology Act, 2000 & Information Technology (Amendment) Act, 2008
正解：B

質問 7：
What of the following is a lawful basis under Article 6 of the General Data Protection Regulation, 2016?
A. Legitimate Interest
B. Performance of Contract
C. Vital Interest
D. Legal Obligation
E. Consent
正解：A,C,D,E

質問 8：
It is essential for an entity to comply with US requirements if it operates a website designed for kids or a website for general audiences that gathers information from individuals known to be under 13 years old. Which of the below regulations is applicable?
A. Personal Information Protection and Electronic Documents Act (PIPEDA)
B. Sarbanes-Oxley Act, 2000
C. Child online protection Act, 1998
D. Gramm-Leach-Bliley Act, 1999
正解：C

質問 9：
According to the privacy statement of an organization, which of the following words is true?
A. The Information Technology (Amendment) Act, 2008 does not require the publication of privacy policies on websites in India
B. In order to follow privacy laws, it is mandatory that there is a phone contact information for the organization's owner in the online privacy statement so that customers can reach out in case of a concern or incident, which can be managed online
C. A privacy statement demonstrates to stakeholders how an organization gathers, uses, discloses, and manages personal information
D. The content of an organization's online privacy statement will be influenced by the applicable laws, and may need to address requirements across geographic boundaries and legal jurisdictions
正解：D