Exam CIPP-US topic 1 question 18 discussion

The correct answer is C. The Department of Health and Human Services. Reference: The IAPP textbook, U.S. Private-Sector Privacy, 4th Edition, 2024, Section 9.2.1 The Disposal Rule: "Enforcement of the Disposal Rule is by the FTC, the federal banking regulators, and the CFPB."

Disposal of information. Appropriate destruction of data or information in any format or media is a key component of information management for both the contracting organization and its vendors. The Disposal Rule under the Fair and Accurate Credit Transactions Act(FACTA) of 2003 sets forth required disposal protections for Financial Institutions. The Disposal Rule requirements provide a good baseline for the disposal of personal information more generally. FACTA enacted a number of consumer protections. It required truncation of credit and debit card numbers, so that receipts do not reveal the full credit or debit card number.