SCENARIO
Please use the following to answer the next QUESTION:
Natalia, CFO of the Nationwide Grill restaurant chain, had never seen her fellow executives so anxious. Last week, a data processing firm used by the company reported that its system may have been hacked, and customer data such as names, addresses, and birthdays may have been compromised. Although the attempt was proven unsuccessful, the scare has prompted several Nationwide Grill executives to Question the company's privacy program at today's meeting.
Alice, a vice president, said that the incident could have opened the door to lawsuits, potentially damaging Nationwide Grill's market position. The Chief Information Officer (CIO), Brendan, tried to assure her that even if there had been an actual breach, the chances of a successful suit against the company were slim. But Alice remained unconvinced.
Spencer - a former CEO and currently a senior advisor - said that he had always warned against the use of contractors for data processing. At the very least, he argued, they should be held contractually liable for telling customers about any security incidents. In his view, Nationwide Grill should not be forced to soil the company name for a problem it did not cause.
One of the business development (BD) executives, Haley, then spoke, imploring everyone to see reason.
"Breaches can happen, despite organizations' best efforts," she remarked. "Reasonable preparedness is key." She reminded everyone of the incident seven years ago when the large grocery chain Tinkerton's had its financial information compromised after a large order of Nationwide Grill frozen dinners. As a long-time BD executive with a solid understanding of Tinkerton's's corporate culture, built up through many years of cultivating relationships, Haley was able to successfully manage the company's incident response.
Spencer replied that acting with reason means allowing security to be handled by the security functions within the company - not BD staff. In a similar way, he said, Human Resources (HR) needs to do a better job training employees to prevent incidents. He pointed out that Nationwide Grill employees are overwhelmed with posters, emails, and memos from both HR and the ethics department related to the company's privacy program. Both the volume and the duplication of information means that it is often ignored altogether.
Spencer said, "The company needs to dedicate itself to its privacy program and set regular in-person trainings for all staff once a month." Alice responded that the suggestion, while well-meaning, is not practical. With many locations, local HR departments need to have flexibility with their training schedules. Silently, Natalia agreed.
The senior advisor, Spencer, has a misconception regarding?

• A. The role of Human Resources employees in an organization's privacy program.
• B. The amount of responsibility that a data controller retains.
• C. The appropriate role of an organization's security department.
• D. The degree to which training can lessen the number of security incidents.

What does it mean to "rationalize" data protection requirements?

• A. Address the less stringent laws and regulations, and inform stakeholders why they are applicable
• B. Determine where laws and regulations are redundant in order to eliminate some from requiring compliance
• C. Evaluate the costs and risks of applicable laws and regulations and address those that have the greatest penalties
• D. Look for overlaps in laws and regulations from which a common solution can be developed

Under the General Data Protection Regulation (GDPR), what are the obligations of a processor that engages a sub-processor?

• A. The processor must Obtain the controllers specifiC written authorization and provide annual reports on the sub-processor'S performance.
• B. The processor must give the controller prior written notice and perform a preliminary audit of the sub- processor.
• C. The processor must receive a written agreement that the sub-processor will be fully liable to the controller for the performance of its obligations in relation to the personal data concerned.
• D. The processor must obtain the consent of the controller and ensure the sub-processor complies with data processing obligations that are equivalent to those that apply to the processor.

(All of the following are the responsibilities of the privacy professional EXCEPT?)

• A. Defining the organization's data strategy.
• B. Monitoring compliance with data protection laws and regulations.
• C. Ensuring privacy audits are regularly conducted.
• D. Conducting privacy impact assessments (PIA).

Last year Ecosoft 8150 was hacked and a number of servers and programs were affected. Since the incident, the company started collecting metrics on data privacy and system outages to try to stop it from happening in the future.
What analysis would be most helpful based on the data they have collected?

• A. Trend analysis.
• B. Business Resiliency.
• C. Compliance analysis.
• D. Return on Investment (ROI).