A parks department discovers a contractor exfiltrated membership PII. Beyond internal policy, what must leadership recognize?
Select an answer to reveal the explanation.
Short Explanation
Catching a contractor stealing membership PII is not just an HR write-up. Depending on the jurisdiction, you may face breach notices, cybercrime reporting, and contractual remedies. Treating it as 'policy only' leaves the city exposed twice.
Full Explanation
Internal policy enforcement is necessary but not sufficient when a parks contractor exfiltrates membership PII. Leadership must recognize that legal and regulatory breach-notification duties and cybercrime issues may apply in addition to contractual and policy responses. Cities can face statutory notice timelines, attorney-general or regulator reporting, and potential criminal referral depending on jurisdiction and facts—even when an NDA or contractor clause also applies.
Claiming only the contractor's NDA matters and that criminal or regulatory breach duties never apply to cities is false comfort; public entities frequently fall under privacy and cybercrime regimes. Assuming public parks data is exempt from privacy and cybercrime considerations by default ignores that membership PII is still personal data regardless of the department's recreational mission. Posting membership PII publicly after terminating the contractor compounds harm and can itself be an unlawful disclosure.
Exam caveat: Policy-only answers are incomplete when the stem mentions theft of PII. Look for options that add legal, regulatory, or law-enforcement dimensions alongside internal action.
Operational check: Activate the incident response plan, preserve evidence, engage counsel for breach-notification analysis, disable contractor access, notify affected members as required, and review vendor offboarding and DLP controls that failed to stop exfiltration.