Certified Information Privacy Professional – Asia (CIPP/A) — Question 18

SCENARIO – Please use the following to answer the next question:
Singabank is a boutique bank in Singapore. After being notified during the hiring process, Singabank employees are subject to constant and thorough monitoring and tracking through CCTV cameras, computer monitoring software and keyboard loggers. Singabank does this to ensure its employees are complying with Singabank's data security policy. Bigbank is now considering acquiring Singabank's retail banking division. As part of its due diligence, Bigbank is seeking for Singabank to disclose to it all of its surveillance material on its employees, whether or not they are part of the retail banking division. Jimmy works in Singabank's investment banking division.
Assuming the monitoring was legal, can Singabank disclose Jimmy's personal data to Bigbank?

Answer options

• A. No, because Jimmy is not in the division that Bigbank seeks to acquire.
• B. No, because the data was collected for the express purpose of complying with Singabank's privacy policies.
• C. Yes, if Singabank informs Jimmy of the disclosure of his personal data before it occurs.
• D. Yes, if Jimmy's personal data is necessary for Bigbank to determine whether to proceed with the acquisition.

Correct answer: C

Explanation

The correct answer is C because transparency with employees about data sharing is critical, and informing Jimmy prior to the disclosure aligns with best practices. Options A and B are incorrect as they do not consider the legal basis of the monitoring and the potential necessity of the data for the acquisition process. Option D, while valid under certain circumstances, does not emphasize the importance of prior notification to Jimmy.