A certification organization fails to notify candidates of a data breach exposing their personal information collected during CBT registration. In states with breach notification laws, this failure is:
-
A
Acceptable if fewer than 500 candidates are affected
-
B
A legal violation that can result in regulatory fines and civil liability
-
C
Permissible if the organization notifies regulators within 90 days
-
D
Only an ethical issue with no legal consequences