Certified Information Privacy Professional – United States (CIPP/US) — Question 89
SCENARIO -
Please use the following to answer the next question:
You are the privacy manager at a privately-owned U.S. company that produces an increasingly popular fitness app called GetFit. After users create an account with their contact information, the app uses a smartphone and a system of connected smartwatch sensors to track users when they exercise. It collects information on location when users walk or run outdoors, as well as general health information (such as heart rate) during all exercise sessions. The app also collects credit card information for payment of the monthly subscription fee.
One Friday, the company's security team contacts you about the discovery of malware on their media server. The team assures you that there was no user data on this server and that, in any case, they found the malware before any damage could be done.
However, on Monday morning the security team contacts you again, this time with the information that they have discovered the same malware on the company's payments server. They suspect it likely that users' credit card information was taken by the attacker. By Monday evening, the situation has gotten dramatically worse, as the security team has also discovered this malware on the company's database server, an infiltration that gives the attacker access to users' profile, health and location information.
After coordinating with the security team, you are asked to meet with senior management and advise them on the company's obligations in connection with the incident. The Chief Financial Officer asks, "If we decide to notify all our users of this incident, are we obligated to provide any of them with a free credit monitoring offer?" The General Counsel wants to know if providing this notice and offer will help the company avoid liability.
Who, if anyone, would the company have to notify immediately following the security team's first call to the privacy manager on Friday?
Answer options
- A. It would have to notify each state's attorney general's office since the app is marketed to consumers.
- B. It would not have to notify anyone since malware intrusions do not trigger breach notification laws.
- C. It would have to notify the Federal Trade Commission (FTC) since there was an incident involving a mobile app.
- D. It would not have to notify anyone since there was no unauthorized access of user data that would be considered personal information under applicable state laws.
Correct answer: D
Explanation
The correct answer is D because, at the time of the first call, the security team confirmed that there was no user data on the media server, indicating there was no unauthorized access to personal information. Options A and C are incorrect because notification to these entities is not required without a breach of personal data. Option B is also incorrect as it overlooks the potential implications of malware intrusions even if no user data was compromised initially.