A bank analyst is about to email an outside vendor a file of customer legal names paired with account numbers. Which handling is required before that file leaves the bank?
Select an answer to reveal the explanation.
Short Explanation
A name stapled to an account number is still a name tag, even when the file looks like ordinary operations data. You need the bank's privacy handling before that pair leaves. Dropping only the name, or hiding it on your screen, does not retire the identifier.
Full Explanation
A legal name joined to an account number is a direct way to point at a customer, so both fields are personal identifiers. Before a copy leaves the bank, the file has to go through the organization's privacy handling: whatever review, minimization, approval, or controlled-transfer steps that program requires for identifiers. Sending account numbers after the names are dropped still releases an identifier; an account number is not a harmless internal index once it sits in an external file. A signed service contract may govern the vendor relationship, but the signature does not review these columns or apply the privacy rules to them. Masking names in a notebook view changes only the analyst's display; the attachment still carries the original identifiers out of the bank. Exam caveat: privacy handling is about the data that leave, not about whether the analyst's own screen hides a column. Operational check: inventory the outbound file's columns, mark names and account numbers as identifiers, and confirm a privacy approval was recorded before the message is sent.