Certified Information Privacy Professional – Asia (CIPP/A) — Question 37

Which European-influenced safeguard was NOT included in Hong Kong or Singapore's personal data protection acts, but was subsequently adopted as a consideration in regulatory guidelines?

Answer options

• A. Controls on automated decision making.
• B. Additional protection for sensitive personal data.
• C. Legitimate interest as a legal basis for processing.
• D. Notice requirements when data is collected from third parties.

Correct answer: D

Explanation

The correct answer is D, as notice requirements for data collected from third parties were not part of the initial acts but were later recognized in regulatory guidelines. Options A, B, and C were included in the acts or are consistent with their principles, thus they do not fit the criteria of being excluded initially.