Notice was provided to everyone visiting a company's website indicating what personal data was being collected and for what purpose it was being used. The IT department recently received a new…

Question

Options

• ADetermine who needs to opt in to the new data usage scenario.
• BRequest the internal audit function to conduct a privacy audit.
• CAssess whether the use of data is consistent with the original purpose.
• DDetermine which department is the data owner and refer to them for approval.

• A
  12% (5)
• B
  5% (2)
• C
  79% (33)
• D
  5% (2)

Explanation

This question tests the privacy principle of purpose limitation. When personal data is collected under a specific notice, it may only be used for the purpose(s) disclosed at the time of collection. The very first step when a new data use is proposed is to assess whether that new use is consistent with the original, disclosed purpose. If it is consistent, no further consent may be needed. If it is not, then-and only then-do subsequent steps apply, such as updating the notice, seeking opt-in consent (A), involving the data owner (D), or initiating an audit (B). Skipping this assessment and proceeding directly to any other action risks violating purpose limitation.

No community discussion yet for this question.