IAPP CIPP-E Exam - Topic 1 Question 94 Discussion

Actual exam question for IAPP's CIPP-E exam

Question #: 94
Topic #: 1

According to the EDPB Guidelines 01/2021 on Examples regarding Personal Data Breach Notification, if exfiltration of job application data (submitted through online application forms and stored on a webserver) resulted in personal information being accessible to unauthorized persons, this would be primarily considered what kind of breach?

AAn integrity breach.

BAn accuracy breach.

CAn availability breach.

DA confidentiality breach.

Show Suggested Answer

Suggested Answer: D

According to the EDPB Guidelines 01/2021 on Examples regarding Personal Data Breach Notification, a confidentiality breach occurs when personal data is disclosed or made available to unauthorized persons. This is the case when exfiltration of job application data from a website results in personal information being accessible to unauthorized persons, such as hackers or competitors. This type of breach may pose a high risk to the rights and freedoms of the data subjects, as it may lead to identity theft, fraud, discrimination, or reputational damage. Therefore, the data controller should notify the data subjects without undue delay, unless the data is encrypted or anonymized, or the controller has taken subsequent measures to ensure that the high risk is no longer likely to materialize.

by Gracie at Sep 18, 2024, 02:39 PM

Limited Time Offer

25%

Off

Get Premium CIPP-E Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Pamella

3 months ago

Really? I thought it might be an availability breach too!

upvoted 0 times

...

Kerry

4 months ago

No doubt, it's a confidentiality issue.

upvoted 0 times

...

Lashaunda

4 months ago

Wait, could it also be seen as an integrity breach?

upvoted 0 times

...

Cora

4 months ago

I agree, unauthorized access is all about confidentiality.

upvoted 0 times

...

Edmond

4 months ago

Definitely a confidentiality breach.

upvoted 0 times

...

Yvonne

5 months ago

I feel like I’ve seen examples where unauthorized access clearly pointed to a confidentiality breach, so I’m going with D as well.

upvoted 0 times

...

Elena

5 months ago

I’m a bit confused here. I thought integrity breaches were about data being altered, but this seems more about access.

upvoted 0 times

...

Marg

5 months ago

I remember practicing a similar question, and I think confidentiality breaches are specifically about unauthorized access. So, I would lean towards option D.

upvoted 0 times

...

Delsie

5 months ago

I think this might be a confidentiality breach since unauthorized access to personal data is involved, but I'm not entirely sure.

upvoted 0 times

...

Herminia

5 months ago

Wait, I'm a little confused. Is this about the integrity of the data, or its availability? I need to re-read the question and the guidelines more carefully to make sure I understand the distinction between the breach types.

upvoted 0 times

...

Galen

5 months ago

Okay, I think I've got this. Based on the EDPB examples, if the job application data was exfiltrated and made accessible to unauthorized parties, that would be considered a confidentiality breach. I'm confident in that answer.

upvoted 0 times

...

Thurman

5 months ago

Hmm, I'm a bit unsure about this one. The question mentions personal data being accessible to unauthorized persons, so I'm leaning towards confidentiality breach, but I want to double-check the definitions in the guidelines.

upvoted 0 times

...

Charlette

5 months ago

This seems like a straightforward question about data breach types. I'll carefully review the EDPB guidelines to determine which breach category best fits the scenario.

upvoted 0 times

...

Josephine

1 year ago

D) A confidentiality breach. Easy peasy. Although I did chuckle at the thought of it being an 'accuracy breach' - like, 'oops, we accidentally leaked all your private info, my bad!'

upvoted 0 times

Myra

1 year ago

D) A confidentiality breach. Yeah, definitely not an 'accuracy breach'!

upvoted 0 times

...

Vallie

1 year ago

D) A confidentiality breach. Easy peasy.

upvoted 0 times

...

Lindy

1 year ago

D) A confidentiality breach.

upvoted 0 times

...

Lenny

1 year ago

C) An availability breach.

upvoted 0 times

...

Stevie

1 year ago

B) An accuracy breach.

upvoted 0 times

...

Anjelica

1 year ago

A) An integrity breach.

upvoted 0 times

...

Kaycee

1 year ago

Hmm, I was debating between C and D, but D makes the most sense. Can't really call it an availability breach if the data was just accessed, not necessarily deleted or modified.

upvoted 0 times