Discuss IAPP CIPP/E Exam Topic 3 Question 96

As a Data Protection Officer for a small bank in the European Union, you receive a data subject access request from one of your customers. The customer provides you with his

name, and has used the email address registered in your system.

What would be the most appropriate way to confirm the identity of the customer?

ARequest that the customer provide his bank account number.

BRequest that the customer answer additional security questions.

CRequest a copy of the customer's last bank account statement.

DRequest a copy of the customer's government-issued ID document.

Suggested Answer: B

According to the CIPP/E study guide, data controllers should use the least intrusive means of verifying the identity of data subjects who make requests under the GDPR. Asking for a copy of an ID document or a bank account statement may be disproportionate and excessive, as they contain more personal data than necessary for authentication. Asking for the bank account number may not be sufficient, as it may be easily obtained by third parties. Therefore, the most appropriate way to confirm the identity of the customer is to ask additional security questions that only the customer would know, such as the date of the last transaction, the amount of the last deposit, or the name of the beneficiary of a recurring payment.

Get Premium CIPP/E Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

33 comments · newest first

Nelida 11 months ago

B could work too, but ID is definitely more reliable.

Rodolfo 11 months ago

Wait, can we really ask for an ID? That feels a bit much.

Rosendo 12 months ago

But what if they don’t have an ID? Seems risky.

Kimberlie 12 months ago

Totally agree, D makes the most sense!

Helga 1 year ago

I think D is the best option. ID is solid proof.

Phil 1 year ago

I’m torn between the last bank statement and the ID. I guess the ID seems more reliable, but I’m not completely sure.

Sheridan 1 year ago

I practiced a similar question where we had to confirm identity, and I think a government-issued ID is the safest choice.

Sanda 1 year ago

I feel like security questions could be a good option, but they might not be foolproof.

Daryl 1 year ago

I think I remember that verifying identity is really important, but I'm not sure if asking for a bank account number is the best way.

Jacki 1 year ago

I feel pretty confident about this one. The best approach would be option B, asking the customer additional security questions. That way, you can verify their identity without requiring sensitive information like an ID document.

Rebbecca 1 year ago

Option A doesn't seem appropriate here, as requesting a bank account number could be a security risk. I'd lean towards B or D, but I'll need to think this through carefully.

Donette 1 year ago

Hmm, I'm a bit unsure about this one. I'm thinking option D might be the safest bet, as requesting a government-issued ID document seems like the most reliable way to verify the customer's identity.

Emerson 1 year ago

This seems like a straightforward data protection question. I'd go with option B and request additional security questions to confirm the customer's identity.

Golda 2 years ago

Haha, imagine if the customer was like, 'My ID? Yeah, I left that at home. Can I just send you a selfie instead?'

Goldie 2 years ago

D is the correct answer. A government ID is the most secure way to confirm the customer's identity.

Reyes 2 years ago

↳ replying to Goldie

Caitlin: Thank you for providing that. Your identity has been confirmed.

Caitlin 2 years ago

↳ replying to Goldie

Sure, here is a copy of my ID.

Nell 2 years ago

↳ replying to Goldie

Can you confirm your identity by providing a copy of your government-issued ID?

Arlette 2 years ago

Hmm, I don't know. Requesting their bank account number seems a bit too invasive, don't you think?

Stefanie 2 years ago

↳ replying to Arlette

Xochitl: Agreed, let's go with that.

Laila 2 years ago

↳ replying to Arlette

User 3: That sounds like a better option to confirm the customer's identity.

Xochitl 2 years ago

↳ replying to Arlette

Maybe we can request additional security questions instead.

Mariann 2 years ago

↳ replying to Arlette

I agree, asking for the bank account number is too much.

Edelmira 2 years ago

I'm not sure, but I think requesting additional security questions could also be a good way to confirm the identity of the customer.

Caitlin 2 years ago

B would be my pick. Security questions are a standard practice to verify the customer's identity.

Reid 2 years ago

↳ replying to Caitlin

Agreed. Security questions can help ensure the customer's identity is confirmed.

Kenneth 2 years ago

↳ replying to Caitlin

That's a good choice. It's important to have multiple layers of verification.

Gianna 2 years ago

↳ replying to Caitlin

B) Request that the customer answer additional security questions.

Micah 2 years ago

I agree with Madelyn. It's important to verify the identity of the customer before providing any personal data.

Sabra 2 years ago

D is the way to go. A government-issued ID is the most reliable way to confirm the customer's identity.

Avery 2 years ago

↳ replying to Sabra

I agree, requesting a copy of the customer's government-issued ID document is the most secure way to confirm identity.

Avery 2 years ago

↳ replying to Sabra

D is the best option. A government-issued ID is the most reliable way to confirm identity.

Madelyn 2 years ago

I think the most appropriate way would be to request a copy of the customer's government-issued ID document.

IAPP CIPP/E Exam - Topic 3 Question 96 Discussion