Examkin

Question

Difficulty: MediumData Privacy and Compliance Regulations

A helpdesk technician receives a support ticket from a customer residing in the European Union who requests that their personal contact profile, communication preferences, and transaction history be permanently deleted from the company's customer relationship management database. Which of the following regulations or privacy rights requires the company to fulfill this request?

  1. The General Data Protection Regulation (GDPR) right to be forgottenAnswer
  2. B
    The Health Insurance Portability and Accountability Act (HIPAA) PHI sanitization rule
  3. C
    The Payment Card Industry Data Security Standard (PCI-DSS) scope limitation policy
  4. D
    The Family Educational Rights and Privacy Act (FERPA) opt-out mandate

Answer

The General Data Protection Regulation (GDPR) right to be forgotten
The General Data Protection Regulation (GDPR) provides EU data subjects with the 'right to be forgotten' (also known as the right to erasure). Under this mandate, organizations processing personal data must permanently delete an individual's personal information upon request if there is no overriding legal obligation to retain it.

Step-by-Step Solution

1
Identify the data subject and regulatory context.
The user is an EU resident requesting data deletion.
Data protection for individuals residing within the EU is governed by the General Data Protection Regulation (GDPR).
2
Determine the specific provision that covers customer data erasure requests.
GDPR includes an explicit 'right to be forgotten' (right to erasure).
This right obligates data controllers to remove personal data upon request when data is no longer necessary for processing.
3
Evaluate alternative regulatory standards to rule out incorrect options.
HIPAA, PCI-DSS, and FERPA cover health data, payment card security, and academic records respectively.
None of these other frameworks establish general consumer personal data erasure rights for EU citizens.

Key Concept

GDPR Data Subject Rights and Data Erasure
Rate this question

Topics

Data Privacy and Compliance Regulations

More questions from this topic