Exam CISSP topic 1 question 44 discussion

and usual residence of the data controller. (7) The Individual Participation Principle. An individual should have the right: b) to have data relating to him communicated to him, within a reasonable time, at a charge, if any, that is not excessive; in a reasonable manner, and in a form that is readily intelligible to him; https://iapp.org/resources/article/fair-information-practices/

D. Individual participation https://www.dhs.gov/sites/default/files/2024-01/Fair%20Information%20Principles_12_2008.pdf Individual Participation: DHS should involve the individual in the process of using PII and, to the extent practicable, seek individual consent for the collection, use, dissemination, and maintenance of PII. DHS should also provide mechanisms for appropriate access, correction, and redress regarding DHS’s use of PII.

Answer D) Individual Participation https://itlaw.fandom.com/wiki/Fair_Information_Practice_Principles#Access/Participation

The practice that applies to a patient requesting their medical records from a web portal, within the context of the Code of Fair Information Practices, is option D: Individual participation. Individual participation refers to the right of individuals to access and participate in the management of their personal information. It empowers individuals to have control over their data and allows them to exercise their rights, such as requesting access to their personal information or requesting corrections or updates to their records. In the given scenario, when a patient requests their medical records from a web portal, they are exercising their right to access their personal information. The hospital, by providing a web portal for such requests, enables individual participation and facilitates the patient's access to their medical records.

Answer is D. https://simson.net/ref/2004/csg357/handouts/01_fips.pdf

D. Individual participation applies to a patient requesting their medical records from a web portal. Individual participation refers to the ability of an individual to have control over what information is collected about them, and how it is used. In the context of a hospital, this would include patients having the right to access their own medical records and request any necessary corrections or deletions.

Code of Fair Information Practices led to Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, first published by the OECD in 1980. Individual Participation Principle 13. An individual should have the right: a) to obtain from a data controller, or otherwise, confirmation of whether or not the data controller has data relating to him.

Individual Participation Principle. Under General Data Protection Regulation (GDPR) and other related regulations, individuals have the right to enquire, at any point in time, about the information we hold on file about them. This principle can be applied to all participating countries if required. Reference : https://www.cemplicity.com/data-protection-principles/

Purpose Specification Principle Subjects should be notified of the reason for the collection of their personal information at the time that it is collected, and organizations should only use it for that stated purpose. ! Individual Participation Principle Subjects should be able to find out whether an organization has their personal information and what that information is, to correct erroneous data, and to challenge denied requests to do so. ! I vote for D (Individual Participation)

Answer is D

Definitely D

Going with D.

https://www.fpc.gov/resources/fipps/ Individual Participation. Agencies should involve the individual in the process of using PII and, to the extent practicable, seek individual consent for the creation, collection, use, processing, storage, maintenance, dissemination, or disclosure of PII. Agencies should also establish procedures to receive and address individuals’ privacy-related complaints and inquiries.

The patient is requesting his/her own info. So I would choose D

A is why the have the information, D is what they have.

https://iapp.org/resources/article/fair-information-practices/ (7) The Individual Participation Principle. An individual should have the right: a) to obtain from a data controller, or otherwise, confirmation of whether or not the data controller has data relating to him; b) to have data relating to him communicated to him, within a reasonable time, at a charge, if any, that is not excessive; in a reasonable manner, and in a form that is readily intelligible to him; c) to be given reasons if a request made under subparagraphs (a) and (b) is denied and to be able to challenge such denial; and d) to challenge data relating to him and, if the challenge is successful, to have the data erased, rectified, completed or amended;

The 'purpose specification principle', that is, the principle that a citizen needs to be informed why the personal data is being collected and the specific purposes for which it will be processed and kept