Certified Information Privacy Professional – United States (CIPP/US) — Question 90

SCENARIO -
Please use the following to answer the next question:

You are the privacy manager at a privately-owned U.S. company that produces an increasingly popular fitness app called GetFit. After users create an account with their contact information, the app uses a smartphone and a system of connected smartwatch sensors to track users when they exercise. It collects information on location when users walk or run outdoors, as well as general health information (such as heart rate) during all exercise sessions. The app also collects credit card information for payment of the monthly subscription fee.

One Friday, the company's security team contacts you about the discovery of malware on their media server. The team assures you that there was no user data on this server and that, in any case, they found the malware before any damage could be done.

However, on Monday morning the security team contacts you again, this time with the information that they have discovered the same malware on the company's payments server. They suspect it likely that users' credit card information was taken by the attacker. By Monday evening, the situation has gotten dramatically worse, as the security team has also discovered this malware on the company's database server, an infiltration that gives the attacker access to users' profile, health and location information.

After coordinating with the security team, you are asked to meet with senior management and advise them on the company's obligations in connection with the incident. The Chief Financial Officer asks, "If we decide to notify all our users of this incident, are we obligated to provide any of them with a free credit monitoring offer?" The General Counsel wants to know if providing this notice and offer will help the company avoid liability.

How does the Monday evening discovery of the malware on the company's database server alter the company's notification obligations, if at all?

Answer options

Correct answer: C

Explanation

The correct answer is C because the Health Breach Notification Rule requires notification to the FTC when health information is compromised in a health app. Option A is incorrect because notifying the U.S. Dept. of Health and Human Services is not specifically required in this context. Option B is wrong since the absence of a social security number or driver's license does not negate the company's obligations regarding health data. Option D is incorrect because the new discovery does indeed change the notification requirements.