Discuss IAPP CIPP/US Exam Topic 8 Question 15

Which of the following statements is most accurate in regard to data breach notifications under federal and

state laws:

AYou must notify the Federal Trade Commission (FTC) in addition to affected individuals if over 500 individuals are receiving notice.

BWhen providing an individual with required notice of a data breach, you must identify what personal information was actually or likely compromised.

CWhen you are required to provide an individual with notice of a data breach under any state's law, you must provide the individual with an offer for free credit monitoring.

DThe only obligations to provide data breach notification are under state law because currently there is no federal law or regulation requiring notice for the breach of personal information.

Suggested Answer: B

Get Premium CIPP/US Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Tamesha 1 year ago

Wait, no federal law at all? That seems surprising!

Willard 1 year ago

D is misleading; there are federal guidelines in place now.

Lawrence 1 year ago

C sounds right, but is it mandatory everywhere?

Alpha 1 year ago

I think B is the most accurate. You have to specify what was compromised.

Rikki 1 year ago

A is true if over 500 people are affected!

Lorrie 1 year ago

I feel like I read somewhere that offering free credit monitoring is not always required, so I'm hesitant about option C.

Edwin 1 year ago

I think option B sounds familiar because we discussed how important it is to specify what information was compromised in our practice questions.

Pearline 1 year ago

I remember studying about the FTC's role in data breaches, but I'm not sure if they always need to be notified.

Lavonna 1 year ago

I thought there were some federal guidelines about data breaches, so I'm not convinced that D is entirely accurate.

Lavonna 1 year ago

I'm a bit confused on this one. Is it asking about the going concern assumption or something else? I'll have to review my notes to make sure I understand the concepts before answering.

Lettie 1 year ago

Option D also looks promising with the Enterprise Communication Strategy and Connected Campus features. I'll need to research those a bit more to see how they could address the requirements.

Jerry 1 year ago

Hmm, let me think through this carefully. I want to make sure I understand all the different patching methods before selecting the right ones.

IAPP CIPP/US Exam - Topic 8 Question 15 Discussion