Exam CIPP-US topic 1 question 209 discussion

The correct answer is: D. When technology is used to monitor employees. Reference: The IAPP textbook, U.S. Private-Sector Privacy, 4th Edition, 2024, Section 12.4.4.3 Policies for Companies Related to Types of Monitoring: "Conducting a privacy impact assessment is good practice". This is an expert from the paragraph covering DLP, but it's relevant to employee monitoring in general: "Privacy concerns have been raised about deployment of DLP. The technology can potentially include surveillance over many or all activities on an endpoint device, such as a phone or laptop that an employee uses. Some endpoint protection programs have included powerful features, such as recording every key stroke, activating the webcam of laptops or smartphones, or tracking the geolocation of the smartphone user without their knowledge. Conducting a privacy impact assessment is good practice, and organizations considering a DLP program should thus consider the likely privacy risks as well as the likely benefits of the program."