A city CRM for 311 tickets includes medical notes from homeless outreach. What privacy approach should the security leader emphasize?
Select an answer to reveal the explanation.
Short Explanation
Medical notes in a 311 system are not the same as a pothole photo. Privacy regimes — whether CCPA-class, health-specific, or other local rules — care about minimization and who can see what. Do not dump health details into open tickets just to keep the form short.
Full Explanation
Health-related notes in a municipal 311 CRM are sensitive personal data and should be treated as a privacy-regulated class requiring minimization, strict access limits, and a lawful basis for processing. The security leader should emphasize those controls without inventing automatic coverage by an inapplicable foreign statute. The correct posture is risk- and law-aware handling under the rules that actually apply to the city, not form convenience.
Assuming GDPR automatically governs every U.S. city CRM and ignoring local law misapplies jurisdiction and can cause teams to miss state privacy, health, or social-service rules that do apply. Storing medical notes in the same open ticket fields used for pothole photos maximizes oversharing inside the workforce and to anyone with broad 311 access. Publishing outreach notes to an open-data portal for 'transparency' is a confidentiality and dignity failure, not a privacy control.
Exam caveat: Sensitive data questions reward minimization and proper legal framing; they punish both careless openness and incorrectly named foreign statutes as automatic answers.
Operational check: Segregate health fields with need-to-know roles, shorten retention, mask notes in default views, train outreach staff on what not to record, and validate processing against counsel's matrix of applicable privacy obligations.