Certified Information Privacy Professional Data Breach Notification Laws 3

Question 1

Which US federal agency serves as the primary enforcer of financial institution data breach obligations under the GLBA Safeguards Rule?

Accepted Answer

FTC (for non-bank financial institutions)

Answer

The FTC enforces the GLBA Safeguards Rule for non-bank financial institutions, while banking regulators enforce it for banks.

Question 2

Under the 2023 FTC Safeguards Rule amendment, non-banking financial institutions must notify the FTC of breaches affecting how many customers?

Accepted Answer

500 or more customers

Answer

The 2023 amendment requires non-banking financial institutions to notify the FTC within 30 days of discovering a breach involving 500 or more customers.

Question 3

What is the primary criticism of having 50 different state breach notification laws instead of a single federal law?

Accepted Answer

Compliance complexity and inconsistent requirements across states

Answer

Fifty separate state laws create compliance burdens for organizations operating nationally due to varying definitions, timelines, and requirements.

Question 4

Which type of information was added to many states' breach notification laws following high-profile biometric data breaches?

Accepted Answer

Biometric data (fingerprints, facial recognition)

Answer

Following high-profile biometric data breaches, many states expanded breach notification laws to include biometric identifiers as covered personal information.

Question 5

Under HIPAA's Breach Notification Rule, which standard determines whether an incident is a 'breach' requiring notification?

Accepted Answer

Whether the PHI was accessed in an unauthorized manner posing low probability of compromise

Answer

HIPAA uses a 'low probability of compromise' standard—if a risk assessment shows low probability that PHI was compromised, it is not a reportable breach.

Certified Information Privacy Professional Practice Test

Certified Information Privacy Professional Practice Test

Certified Information Privacy Professional Data Breach Notification Laws 3