A city CRM for 311 tickets includes medical notes from homeless outreach. What privacy approach should the security leader emphasize?
Select an answer to reveal the explanation.
Short Explanation
Medical notes in a 311 system are not the same as a pothole photo. Privacy regimes — whether CCPA-class, health-specific, or other local rules — care about minimization and who can see what. Do not dump health details into open tickets just to keep the form short.
Full Explanation
Privacy compliance is a class of obligations that includes minimization, purpose limitation, access control, and lawful bases for processing sensitive personal data. Embedding medical outreach notes in a general 311 CRM elevates risk regardless of whether a specific foreign statute like GDPR automatically applies. Leaders should apply privacy principles and the actually applicable local, state, or sectoral rules rather than assuming a mismatched jurisdiction or treating health notes as ordinary open-data content.