Susan, an attorney, has been hired to fill a new position at Widgets Inc. The position is Chief Privacy Officer (CPO). What is the primary function of her new role?

A.
Ensuring the protection of partner data

B.
Ensuring the accuracy and protection of company financial information

C.
Ensuring that security policies are defined and enforced

D.
Ensuring the protection of customer, company, and employee data

Explanation:
D: The Chief Privacy Officer (CPO) position is being created by companies in response to the increasing demands on organizations to protect myriad types of data. The CPO
is responsible for ensuring the security of customer, company, and employee data, which keeps the company free from legal prosecution andhopefullyout of the headlines.
Thus, the CPO is directly involved with setting policies on how data is collected, protected, and distributed to third parties. The CPO is usually an attorney and reports to the
Chief Security Officer.
A is incorrect because protecting partner data is just a small subset of all the data the CPO is responsible for protecting. CPOs are responsible for ensuring the protection of
customer, company, and employee data. Partner data is among the various types of data that the CPO is responsible for protecting. In addition, the CPO is responsible for
knowing how its company’s suppliers, partners, and other third parties are protecting its sensitive information. Many times, companies will need to review these other parties
(which have copies of data needing protection).
B is incorrect because the accuracy of financial information is the responsibility of its data ownerthe Chief Financial Officer (CFO). The CFO is responsible for the
corporation’s account and financial activities, and the overall financial structure of the organization. The CPO is responsible for helping to ensure the secrecy of this data, but not
the accuracy of the data. The financial information is also a small subset of all the data types the CPO is responsible for protecting.
C is incorrect because the definition and enforcement of security policies is the responsibility of senior management, commonly delegated to the CISO or CSOnot the CPO.
A security policy is an overall general statement that dictates what role security plays within the organization. The CPO’s responsibilities as they relate to policies are to
contribute to the setting of data protection policies, including how data is collected, protected, and distributed to third parties.