CGRC Privacy and Data Protection Flashcards

A federal agency's CGRC assessor is reviewing a new system that processes records subject to the Privacy Act of 1974. The system owner states that a PIA was completed two years ago and no changes have occurred, but the assessor learns the agency recently began matching the system's data against a commercial data broker's dataset to enrich records. What is the MOST appropriate action?

Answer: Require the PIA and the applicable SORN to be reviewed and updated, because merging in new data sources is a change that creates new privacy risk

OMB Circular A-130 and the RMF require a PIA to be updated when a system change creates new privacy risks, such as merging databases or adding commercial data sources. Because the data use and the collected information have changed, the SORN may also need revision. Waiting for a scheduled review ignores the trigger-based update requirement.

During the Select step of the RMF, an organization is deciding how to allocate responsibility for privacy controls on a system hosted by a cloud provider. Which statement best reflects NIST SP 800-37 Rev. 2 and SP 800-53 Rev. 5 guidance on this arrangement?

Answer: The senior agency official for privacy designates controls as common, hybrid, or system-specific, and the organization remains accountable for privacy risk even when controls are provided by the provider

Under NIST guidance, the SAOP or privacy program leads the selection and designation of privacy controls as common, hybrid, or system-specific. Even where a provider supplies controls, the organization retains accountability for the privacy risk and must obtain assurance through assessment evidence.

A system processes personally identifiable information, and a privacy risk assessment finds that individuals could suffer embarrassment and loss of trust if data were disclosed, even though the data would not cause financial loss or identity theft. How does the NIST Privacy Framework and NISTIR 8062 thinking differ from a traditional security-only risk model in analyzing this situation?

Answer: It considers problematic data actions that cause adverse effects on individuals, such as embarrassment or loss of autonomy, separate from the organizational security impact

NISTIR 8062 and the NIST Privacy Framework focus on problematic data actions and their adverse effects on individuals, including dignity-type harms, which differ from security risk to the organization. Privacy risk therefore needs its own analysis alongside security categorization.

An agency plans to reuse PII originally collected for benefits eligibility to train an analytics model for fraud detection. The collection notice stated only the eligibility purpose. Which privacy principle and control family is MOST directly implicated, and what should the CGRC professional recommend?

Answer: Purpose Specification and Use Limitation; recommend evaluating compatibility with the original purpose, and updating notices or obtaining authorization before the new use

Using PII for a purpose beyond the one disclosed implicates purpose specification and use limitation, as reflected in the Fair Information Practice Principles and the NIST SP 800-53 PT (PII Processing and Transparency) family. The new use must be evaluated for compatibility, and notices (and the SORN where applicable) updated or consent obtained. Encryption addresses safeguards, not authorized purpose.

After a breach involving PII, an agency's incident response team has contained the incident. Under OMB M-17-12 guidance, which factor is MOST important when the agency assesses the risk of harm to affected individuals to decide whether to notify them?

Answer: The nature and sensitivity of the PII, the likelihood it will be accessed and used, and the type of breach, together with the encryption status of the data

OMB M-17-12 directs agencies to assess risk of harm using factors including the nature and sensitivity of the PII, the likelihood of access and use, and the type of breach, which includes whether the data was protected, for example by encryption. The record count or media attention alone do not determine the risk of harm.

A system's authorization package contains a PIA that concludes a particular dataset can be treated as de-identified because direct identifiers were removed. The assessor notes the dataset retains full ZIP code, exact date of birth, and gender. What is the BEST assessment of this conclusion?

Answer: It is questionable because these quasi-identifiers can be combined to re-identify individuals, so a re-identification risk analysis should be required

Removing direct identifiers does not ensure de-identification. ZIP code, exact date of birth, and gender are quasi-identifiers that, in combination, can uniquely identify a large share of the population. NIST guidance (SP 800-122, NISTIR 8053) says re-identification risk must be assessed. Encryption does not change identifiability, and the risk exists regardless of network boundary.