Exam CIPM topic 1 question 9 discussion

The most logical answer is C.

It would not be practical for laws to list specific technical measures, as these evolve over time

Most privacy laws focus on outcomes e.g., ensuring data security rather than specifying exact technical security measures. This allows organisations the flexibility to choose controls that would work best for their environment.

The correct answer is C. Most privacy legislation does not specify the exact types of technical security controls that must be implemented. Instead, they often require that organizations implement "appropriate" or "reasonable" security measures, leaving the specifics up to the organizations to determine based on their particular circumstances and risks.

Both B and C options are incorrect.

C. Most privacy legislation lists the types of technical security controls that must be implemented. Explanation: While privacy legislation often requires organizations to protect the privacy and security of personal data, it typically does not prescribe specific technical security controls. Instead, it often outlines general principles and requirements for safeguarding information. The choice of specific technical security controls is left to the organizations themselves, considering their unique circumstances and the nature of the data they handle.

Jurisdictions might have different controls requirements

The false statement regarding the use of technical security controls is: B. Technical security controls deployed for one jurisdiction often satisfy another jurisdiction. This is false because technical security controls that are required in one jurisdiction may not be sufficient to meet the requirements of another jurisdiction. For example, the European Union's General Data Protection Regulation (GDPR) has stricter requirements for technical security controls than the United States' Health Insurance Portability and Accountability Act (HIPAA).

Answer is C because the question ask for False about data security. While Technical Security Controls are part of data goverance strategy but it in most legislation never really list what technical control required. "C. Most privacy legislation lists the types of technical security controls that must be implemented. "

While technical security controls play a crucial role in safeguarding data, they are not synonymous with data governance

Technical Security Controls are part of data governance strategy

C maybe the correct answer

A or C