CIPP/US: Certified Information Privacy Professional/United StatesDemo

By IAPP · Question Mode

QuestionQ228

State Privacy Laws

A company plans to use an algorithm to screen job applications by assigning suitability scores and automatically sending rejection letters when the score falls below a specified threshold.

What would the company need to include in its plans to comply with requirements in both Virginia’s and Colorado’s privacy laws?

  • A A notification to the state authority
  • B A third-party algorithm validation
  • C A human oversight component
  • D A formal risk assessment
Explanation

Automated scoring that determines whether an applicant receives an employment opportunity is profiling with a significant effect on the individual. Both Virginia and Colorado require controllers to conduct and document data protection assessments for covered high-risk profiling activities, including profiling that can create unfair or discriminatory outcomes or other heightened risks of harm.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!