ITPEC IP April 2025 Question 36

Topic: Security

Among the descriptions A through D of how to handle a contact list that includes customer names, addresses, and other information, which of the following contains all and only the appropriate descriptions in terms of personal information protection?

AEven if a customer asks to check his/her own registration information, this cannot be disclosed on the grounds of information protection.BA list of all names and addresses is extracted from the contact list and is sent to all the customers to have them check for errors.CA CD-ROM that includes contact list data is to be shredded before it is discarded.DContact list data is to be encrypted when it is stored in a file.

Explanation

C and D — protect the stored list and destroy it when it is discarded; disclose it only to the person it describes.

  • •A: not appropriate. People have the right to ask what information is held about them; after confirming the requester's identity, the company should disclose that person's own record.
  • •B: not appropriate. Sending every customer the full list discloses all the other customers' names and addresses, itself a leak. Each customer should be shown only his or her own entry.
  • •C: appropriate. Shredding the CD-ROM makes the data unrecoverable, so the discarded disc cannot leak it.
  • •D: appropriate. Encryption keeps the file unreadable if it is copied or stolen.

Answer (d)

Why not others:

  • •(a) A, C, D — includes A, refusing a customer his or her own data
  • •(b) A, D — includes A and leaves out C
  • •(c) B, C — includes B, a disclosure to every customer, and leaves out D

Key rule: Personal information is protected against everyone except the person it describes: keep it from third parties at every stage from storage to disposal, but let the person see and correct his or her own data.

Security · AI-written, may contain errors

Practice this exam

This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.