CIPM: Certified Information Privacy ManagerDemo

Question

A lead applied scientist at your company believes machine learning could proactively resolve customer issues. She asks for access to all company customer data and several publicly available datasets.

Which of the following is not an appropriate next step?

A Understanding the geographic location of your customers.
B Providing a public disclosure to all customers describing the purpose and nature of processing.
C Checking your company's public privacy notice to ensure this processing is in line with current disclosures.
D Requesting further information from your scientist to understand the goal of the model and the eventual operational description.

Explanation

Before granting broad access to customer data for a new analytics or machine-learning use case, a privacy program should first scope and assess the request: understanding relevant jurisdictional factors such as customer location (since this determines which privacy laws apply), confirming whether the existing public privacy notice already covers this type of processing, and gathering enough detail from the requesting team about the model's purpose and eventual operational use to support a proper privacy assessment. Issuing a public disclosure to all customers is a potential outcome of that assessment, not an appropriate next step to take before the scope, legal basis, and necessity of the processing have been evaluated, since it risks a premature or inaccurate public statement and bypasses the required internal review.

CIPM: Certified Information Privacy ManagerDemo

AstroTutor

Notes

Readiness

QuestionQ319

Community Discussion