CIPP/US: Certified Information Privacy Professional/United StatesDemo

By IAPP · Question Mode

QuestionQ242

Federal Privacy Laws

A financial technology company uses an AI-powered system to assess loan applications. The system evaluates multiple data points, including credit history, income level, and social-media behavior, to produce approval or denial decisions. Applicants are not told that AI is used in the evaluation process, and they have no way to challenge a denial.

Which option presents the most significant legal or regulatory risk under U.S. privacy and consumer-protection laws?

  • A Using publicly available social media data in the loan decision-making process.
  • B Relying on third-party data sources for certain elements of the decision-making model.
  • C Failing to conduct a Privacy Impact Assessment (PIA) before deploying the AI system.
  • D Not informing applicants about the use of AI and offering no process to exercise their rights.
Explanation

A credit denial is an adverse action, and ECOA and Regulation B require a creditor to provide an adverse-action notice that states the specific principal reasons for the denial. Those requirements apply even when the decision uses AI or complex algorithms. Failing to provide meaningful notice and a way for consumers to exercise applicable rights creates substantial consumer-protection and credit-regulation exposure; use of public social-media data or third-party data is not inherently unlawful, and a PIA is not generally required for a private lender under federal law.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!