CIPP/US: Certified Information Privacy Professional/United StatesDemo

By IAPP · Question Mode

QuestionQ156

Workplace Privacy

What response should be provided to the General Counsel?

  • A "Users can only sue us if we violate the state breach notification laws."
  • B "This is a health data incident subject to HIPAA, so the private right of action does not apply."
  • C "Users cannot sue us, because only federal and state regulators have enforcement authority in data breaches."
  • D "Even if we provide notice, we may still face liability due to mishandling the data and causing potential harm to users."
Explanation

Providing breach notice and a credit-monitoring offer does not immunize a company from liability. A consumer fitness app that collects health, location, profile, and payment information may still face claims or regulatory enforcement based on allegedly inadequate privacy or data-security practices and resulting potential consumer harm. HIPAA does not automatically cover a consumer health app; the FTC explains that many health apps are instead subject to other protections, including FTC requirements.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!