CGRC Privacy and Data Protection Flashcards

A US federal agency is authorizing a cloud-hosted HR system that collects employee Social Security numbers and performance reviews. The Privacy Threshold Analysis (PTA) concludes the system contains PII. Which sequence best reflects how the CGRC practitioner should integrate privacy into the RMF process under NIST SP 800-37 Rev. 2?

Answer: Conduct a PIA, have the Senior Agency Official for Privacy (SAOP) review privacy control selection during Categorize/Select, and include privacy controls in the assessment and authorization package

NIST SP 800-37 Rev. 2 integrates privacy throughout the RMF. The PTA/PIA informs categorization and control selection, the SAOP (or designee) is involved in selecting and assessing privacy controls, and privacy controls from SP 800-53 Rev. 5 (which integrates privacy controls) are included in the authorization package. Privacy is not deferred until after authorization, is not solely the system owner's decision, and does not replace the 800-53 catalog.

An organization's system processes PII for a purpose that was not described in the original System of Records Notice (SORN). The program office wants to begin using the data for a new, compatible-looking analytics function. Which privacy principle is most directly at risk, and what is the correct action?

Answer: Purpose specification/use limitation; the organization must assess whether the new use is compatible and, if required, publish a revised SORN or obtain consent before proceeding

Using PII for a purpose beyond what was specified in the SORN implicates purpose specification and use limitation (Fair Information Practice Principles; Privacy Act routine-use rules). The organization must evaluate compatibility and, where required, publish a new or modified SORN (or routine use) and provide notice before the new use begins. Simply deleting data or updating training does not address the unauthorized secondary use.

During control assessment, the assessor finds that a system's de-identification process removes names and SSNs but retains full 5-digit ZIP code, exact birth date, and sex for all records in a small rural population. Which conclusion is most defensible?

Answer: The dataset remains at significant re-identification risk because quasi-identifiers can be linked with external data, so additional generalization or expert determination is needed

Removing direct identifiers is insufficient. ZIP code, full birth date, and sex are well-known quasi-identifiers that can uniquely identify a large share of individuals, especially in small populations. Effective de-identification requires generalization/suppression (e.g., HIPAA Safe Harbor limits) or statistical expert determination. Encryption protects confidentiality at rest but does not reduce re-identification risk of the data's content once it is accessed or released.

A multinational company's US-based system receives personal data of EU data subjects. The organization wants to rely on Standard Contractual Clauses (SCCs) for the transfer. After the Schrems II decision, what additional step is required of the data exporter?

Answer: Perform a transfer impact assessment to determine whether the destination country's laws allow the clauses to be honored, and apply supplementary measures where necessary

Following Schrems II (CJEU, 2020), SCCs remain valid but exporters must assess on a case-by-case basis whether the destination country's laws (e.g., government surveillance access) undermine the protections, and adopt supplementary technical, contractual, or organizational measures if needed. Privacy Shield was invalidated, and individual consent for every record is not a required mechanism.

A system security plan lists PT-3 (Personally Identifiable Information Processing Purposes) and PM-5(1) (Inventory of Personally Identifiable Information) as implemented. During assessment, the inventory of PII is found to omit data copied into a development/test environment. Which finding is most appropriate?

Answer: A deficiency in PII inventory completeness, with associated risk of unmanaged PII exposure, requiring remediation such as inventory update and masking/de-identification of test data (e.g., SA-3(2) / SI-12(2) practices)

PM-5(1) requires an inventory of systems and applications that process PII, and PII processing in non-production environments is still PII processing. Using live PII in test environments creates unmanaged exposure; remediation includes updating the inventory and minimizing, masking, or de-identifying PII used in testing and development (SA-3(2) addresses use of live data in pre-production, and SI-12(2) addresses minimization of PII in testing, training, and research). The finding is therefore tied to inventory accuracy and data minimization, not just access or physical controls.

A federal system experiences a breach in which a laptop containing unencrypted PII of 1,200 individuals is lost. Under OMB M-17-12 guidance, which factor set should the agency primarily use to assess the risk of harm to affected individuals and determine notification actions?

Answer: Nature and sensitivity of the PII, likelihood of access and use, and type of breach, which together drive the risk of harm assessment

OMB M-17-12 directs agencies to assess the risk of harm using the nature and sensitivity of the PII, the likelihood that the PII will be accessed and used, and the type of breach (e.g., loss, theft, or unauthorized disclosure). These factors guide whether and how to notify individuals and what mitigation to offer. No fixed record-count threshold exempts notification, and cost or equipment ownership are not the governing assessment factors.