IAPP Updated CIPM Exam Questions and Answers by alexis

The United States federal law that requires financial institutions to declare their personal data collection practices is the Gramm-Leach-Bliley Act (GLBA) of 1999. The GLBA is also known as the Financial Services Modernization Act or the Financial Modernization Act10 The GLBA regulates how financial institutions collect, use, disclose, and protect the nonpublic personal information of their customers11 The GLBA requires financial institutions to provide a privacy notice to their customers that explains what kinds of information they collect, how they use and share that information, and how they safeguard that information12 The GLBA also gives customers the right to opt out of certain information sharing practices with third parties13

The other options are not US federal laws that require financial institutions to declare their personal data collection practices. The Kennedy-Hatch Disclosure Act of 1997 is a proposed but not enacted legislation that would have required health insurers to disclose their policies and practices regarding the use and disclosure of genetic information14 SUPCLA, or the federal Superprivacy Act of 2001, is a fictional law that does not exist in reality. The Financial Portability and Accountability Act of 2006 is also a fictional law that does not exist in reality, although it may be confused with the Health Insurance Portability and Accountability Act (HIPAA) of 1996, which regulates the privacy and security of health information15 References: 10: Gramm-Leach-Bliley Act | Federal Trade Commission; 11: Financial Privacy | Federal Trade Commission; 12: Financial Privacy | Federal Trade Commission; 13: Financial Privacy | Federal Trade Commission; 14: S. 422 (105th): Genetic Information Nondiscrimination in Health Insurance Act of 1997; 15: Health Information Privacy | HHS.gov

The most helpful approach to address Penny’s IT concerns is to undertake a tabletop exercise. A tabletop exercise is a simulated scenario that tests the organization’s ability to respond to a security incident, such as a data breach, a cyberattack, or a malware infection. A tabletop exercise typically involves:

• A facilitator who guides the participants through the scenario and injects additional challenges or variables
• A scenario that describes a plausible security incident based on real-world threats or past incidents
• A set of objectives that define the expected outcomes and goals of the exercise
• A set of questions that prompt the participants to discuss their roles, responsibilities, actions, decisions, and communications during the incident response process
• A feedback mechanism that collects the participants’ opinions and suggestions on how to improve the incident response plan and capabilities

A tabletop exercise can help Penny and her CEO with their objectives by:

• Enhancing the awareness and skills of the IT team and other stakeholders involved in incident response
• Identifying and addressing the gaps, weaknesses, and challenges in the incident response plan and process
• Improving the coordination and collaboration among the IT team and other stakeholders during incident response
• Evaluating and validating the effectiveness and efficiency of the incident response plan and process
• Generating and implementing lessons learned and best practices for incident response

The results from a previous information audit can be leveraged in a PIA process. An information audit is a systematic review of the personal data that an organization holds, such as its sources, purposes, locations, flows, and retention periods. An information audit can provide valuable input for a PIA, as it can help identify the types and categories of personal data that will be involved in the project, as well as the potential risks and impacts associated with them. References: IAPP CIPM Study Guide, page 27.

 All of the changes listed will likely trigger a data inventory update except for the passage of a new privacy regulation. A data inventory is a record of all personal data that an organization collects, processes, stores, shares, or disposes of. A data inventory helps an organization understand what types of personal data it holds, where it comes from, where it goes, and how it is protected. A data inventory should be updated regularly to reflect any changes in the organization’s data processing activities or practices. Some examples of changes that would trigger a data inventory update are outsourcing a business function, acquiring a new subsidiary, or onboarding a new vendor. These changes may involve new sources or destinations of personal data, new purposes or categories of processing, new security measures or risks, or new contractual agreements or obligations. The passage of a new privacy regulation may not trigger a data inventory update unless it affects the organization’s existing data processing activities or practices. However, it may trigger a compliance assessment or gap analysis to determine if the organization needs to make any adjustments to its privacy program or policies to meet the new legal requirements. References: Data Inventory Hub; Data Inventory: What It Is & How To Create One