Exam CIPT topic 1 question 123 discussion

Actual exam question from IAPP's CIPT

Question #: 123
Topic #: 1

A privacy engineer reviews a newly developed on-line registration page on a company's website. The purpose of the page is to enable corporate customers to submit a returns / refund request for physical goods. The page displays the following data capture fields: company name, account reference, company address, contact name, email address, contact phone number, product name, quantity, issue description and company bank account details.
After her review, the privacy engineer recommends setting certain capture fields as `non-mandatory`. Setting which of the following fields as `non-mandatory` would be the best example of the principle of data minimization?

A. The contact phone number field.
B. The company address and name.
C. The contact name and email address.
D. The company bank account detail field.

Show Suggested Answer

Suggested Answer: B 🗳️

by 187san at Dec. 23, 2021, 1:16 p.m.

Comments

Submit Cancel

Ssourav

11 months, 1 week ago

Selected Answer: D

D. The company bank account detail field. Explanation: Setting the company bank account details field as non-mandatory exemplifies data minimization by ensuring that only necessary information is collected. Since the bank account details are not required to process a return or refund request, omitting this field reduces the amount of sensitive data collected.

upvoted 1 times

...

PaigeH7

1 year, 3 months ago

Selected Answer: A

You don't necessarily have to have the contact number for a refund

upvoted 1 times

...

Stants

1 year, 4 months ago

The best example of applying the principle of data minimization in this scenario would be: A. The contact phone number field. Here's why: The contact phone number may not always be necessary for processing return/refund requests. While it can be useful for communication purposes, it may not be essential for every transaction. By making the contact phone number field non-mandatory, the company can reduce the amount of data collected from users, aligning with the principle of data minimization. Other fields like company name, account reference, and product details are likely essential for processing the request and may need to be mandatory to ensure the request is valid and can be efficiently handled. Therefore, making the contact phone number field non-mandatory strikes a balance between collecting necessary information for processing requests and minimizing the collection of potentially unnecessary data.

upvoted 2 times

...

pipzz

3 years ago

If account reference is provided then they should not need to provide company name and address because that will be linked to account reference on the customer database.

upvoted 1 times

...