Discuss IAPP CIPM Exam Topic 7 Question 58

Your company provides a SaaS tool for B2B services and does not interact with individual consumers. A client's current employee reaches out with a right to delete request. what is the most appropriate response?

AForward the request to the contact on file for the client asking them how they would like you to proceed.

BRedirect the individual back to their employer to understand their rights and how this might impact access to company tools.

CProcess the request assuming that the individual understands the implications to their organization if their information is deleted.

DExplain you are unable to process the request because business contact information and associated data is not covered under privacy rights laws.

Suggested Answer: B

If your organization provides a SaaS tool for B2B services and does not interact with individual consumers, and a client's current employee reaches out with a right to delete request, the most appropriate response is to redirect the individual back to their employer to understand their rights and how this might impact access to company tools. This is because your organization is acting as a processor for the client, who is the controller of the employee's personal dat

a. The controller is responsible for determining the purposes and means of processing personal data, as well as responding to data subject requests. The processor should only process personal data on behalf of and in accordance with the instructions of the controller.Therefore, you should not forward the request to the client, process the request without consulting the client, or deny the request based on business contact information being exempt from privacy rights laws1,2.Reference:CIPM - International Association of Privacy Professionals,Free CIPM Study Guide - International Association of Privacy Professionals

Get Premium CIPM Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

22 comments · newest first

Jesusa 11 months ago

Option D is misleading, there are privacy laws that might apply.

Golda 11 months ago

Wait, can we really just ignore their request? Sounds sketchy.

Katina 12 months ago

Option B seems more appropriate, they should go through their employer.

Titus 12 months ago

Totally agree, gotta check with the client first!

Sabra 1 year ago

I think option A is the best way to handle this.

Mabelle 1 year ago

I recall that business data is often treated differently under privacy laws, so option D might be correct, but I’m not completely confident about it.

Cora 1 year ago

I practiced a similar question where we had to consider the implications of data deletion. Processing the request without confirmation seems risky, right?

Pete 1 year ago

I’m not entirely sure, but I feel like redirecting the individual back to their employer could be a good way to handle it. It seems like the right approach.

Cathern 1 year ago

I think I remember that we should always verify the authority of the requester, so maybe forwarding it to the client contact is the safest option?

Isreal 1 year ago

I've got this one! The best approach is to forward the request to the client contact and let them guide us on how to proceed. That way we're covering our bases.

Margurite 1 year ago

Okay, I think the key here is to understand the client's policies and procedures around data privacy. We'll want to make sure we're handling this request properly.

Jeannetta 1 year ago

This seems like a tricky one. I'll need to think carefully about the implications of each response option.

Dexter 1 year ago

Hmm, I'm a bit confused here. I'm not sure if we can just process the request or if we need to involve the client contact.

Arthur 1 year ago

I'm a little confused by this question. There are a few different Dynamics 365 options listed, and I'm not sure which one would be the best fit. I'd probably need to do some research on the capabilities of each one to determine the right solution for the company's needs.

Shanda 1 year ago

This seems like a straightforward question about report creation in Office. Based on the information provided, I think the Blank Report option is the way to go to create a new report in the Design view. I'm feeling confident about this one.

Marjory 1 year ago

Okay, let me think this through. The company wants a legal obligation for the exchange rate, but also a separation from the underlying transaction. I'm leaning towards a forward contract, as that seems to match the requirements the best.

Bambi 1 year ago

Okay, I think I've got this. The data represents counts of calls, so it's discrete and not continuous. That means it's likely a categorical variable. I'll go with option A.

Joesph 1 year ago

No problem, I've got this. The mean is 900 Kelvin and the standard deviation is 54, so the coefficient of variation is 54 / 900 = 0.06 or 6%.

Vilma 2 years ago

I think in that case we should follow option D and explain our position regarding privacy rights.

Jade 2 years ago

But what if the client's contact doesn't respond? Should we just delete the data?

Nadine 3 years ago

I agree with Pansy. The client should have the final say on this matter.

Pansy 3 years ago

I think we should forward the request to the client's contact. It's their data after all.

IAPP CIPM Exam - Topic 7 Question 58 Discussion