Passed Exam Today CIPM

 The statement that is true about the Data Protection Impact Assessment (DPIA) process as required under the General Data Protection Regulation (GDPR) is that the DPIA must include a description of the proposed processing operation and its purpose. According to Article 35(7) of the GDPR, a DPIA shall contain at least:

• “a systematic description of the envisaged processing operations and the purposes of the processing”;
• “an assessment of the necessity and proportionality of the processing operations in relation to the purposes”;
• “an assessment of the risks to the rights and freedoms of data subjects”;
• “the measures envisaged to address the risks”;
• “safeguards”, “security measures”;
• “mechanisms to ensure the protection of personal data”;
• “to demonstrate compliance with this Regulation taking into account the rights and legitimate interests of data subjects and other persons concerned”5

Therefore, a DPIA must include a description of what data processing activities are planned and why they are needed as part of its content. This helps to provide a clear overview of the processing operation and its objectives as well as to assess its necessity and proportionality in relation to its purposes6 References: 5: [General Data Protection Regulation (GDPR) – Official Legal Text], Article 35(7); 6: Data protection impact assessments | ICO

To improve the facility’s system of data security, Anton should consider following through with the plan for controlled access at the company headquarters. This plan would help to prevent unauthorized physical access to the paper files, disks, and old computers that contain personal data of employees and customers. Physical security is an important aspect of data security that involves protecting hardware and storage devices from theft, damage, or tampering1 By placing restrictions on who can enter the premises or access certain areas or rooms, Anton can reduce the risk of data breaches or incidents caused by intruders or insiders2 He can also implement locks, alarms, cameras, or guards to enhance the physical security of the facility3 References: 1: Physical Security: What Is It?; 2: [Physical Security: Why It’s Important & How To Implement It]; 3: [Physical Security Best Practices: 10 Tips to Secure Your Workplace]

A Privacy Impact Assessment (PIA) is a process that helps to identify and mitigate the privacy risks of a project or activity that involves personal data. A PIA is usually required when there is a new or significant change in the way personal data is collected, used, or disclosed. Therefore, a PIA would be the least likely to be required if a company created a credit-scoring platform five years ago, as this would not be a new or significant change. The other situations involve new or changed processing of personal data that could have privacy impacts, such as sensitive data (health or children’s data), profiling data (user profiles), or large-scale data (patient’s file). References: CIPM Study Guide, page 30; Guide to undertaking privacy impact assessments.

The statement that is false regarding the use of technical security controls is that most privacy legislation lists the types of technical security controls that must be implemented. Technical security controls are the hardware and software components that protect a system against cyberattacks, such as encryption, firewalls, antivirus software, and access control mechanisms1 However, most privacy legislation does not prescribe specific types of technical security controls that must be implemented by organizations. Instead, they usually require organizations to implement reasonable or appropriate technical security measures to protect personal data from unauthorized or unlawful access, use, disclosure, alteration, or destruction23 The exact level and type of technical security controls may depend on various factors, such as the nature and sensitivity of the data, the risks and threats involved, the state of the art technology available, and the cost and feasibility of implementation4 Therefore, organizations have some flexibility and discretion in choosing the most suitable technical security controls for their data processing activities. References: 1: Technical Controls — Cybersecurity Resilience - Resilient Energy Platform; 2: [General Data Protection Regulation (GDPR) – Official Legal Text], Article 32; 3: [Privacy Act 1988], Schedule 1 - Australian Privacy Principles (APPs), APP 11; 4: Technical Security Controls: Encryption, Firewalls & More