Part 716-Privacy of Consumer Financial Information

Question 1

The NCUA’s privacy regs define a member as an individual with a continuing relationship at the credit union

Answer 1

True

Question 2

If a credit union does not anticipate disclosing information to affiliates, or non-affiliated, third parties for marketing purposes, the credit union is completely exempt from the NCUA privacy regulations

Answer 2

False

Question 3

Verbal privacy notices are OK if the member signs a statement acknowledging the receipt of the verbal notice

Answer 3

False

Question 4

If your credit Union provides nonpublic personal information with a nonaffiliated, third-party vendor or marketing purposes, your credit Union must provide your members with the opportunity to opt out of that information sharing

Answer 4

True

Question 5

If a credit union does not anticipate closing information to affiliates or nonaffiliated third parties for marketing purposes, the credit union can provide a shortened simplified notice

Answer 5

True

Question 6

A member must write and send the credit union and extensive letter, requesting to opt out of information sharing

Answer 6

False

Question 7

How a service provider ( a vendor) safeguards members information is not a concern for your credit Union

Answer 7

False

Question 8

If your credit Union wants to provide members information to a vendor to sell products, it must disclose this to members, provide them with an opt out notice, and make it easy for members to opt out from the vendors disclosure

Answer 8

True

Question 9

There are significant penalties in civil liability for your credit Union, for violating the NCUA privacy regulations

Answer 9

False

Question 10

Under the NCUA’s requirement for a credit union member information security program. Staff training on the security program is not a requirement, but is a good practice.

Answer 10

False

Question 11

The NCUA requires a credit unions Board of Directors to not only assist in writing the policy for the credit union member information security program, but also to conduct an annual audit of the program as well

Answer 11

False

Question 12

A credit Union is required to include the electronic protection of member information, and its members information, security program which includes

1. developing the monitoring policies and procedures, and
2. identifying and reasonably foreseeable internal and external threats based on the IT environment, and the products and services it provides

Answer 12

True

Question 13

NCUA guidance provided to credit unions concerning electronic authentication programs includes

1. Developing a process that is consistent and supports the credit unions, overall security and risk assessment program
2. That is periodically reviewed and
3. That includes auditing and monitoring features.

Answer 13

True

Question 14

To avoid problems with pre-text calling and identity theft. The NCUA recommends that the credit union only give account information to the primary member on the account.

Answer 14

False

Question 15

The NCUA regulations require an insured credit union to have a data security response program to address when there is unauthorized access to (a breach of)
member information. Such a program includes
1. accessing the nature and scope of the breach. (What information systems and member information was accessed)
2. notifying the NCUA regional Director, or state agency of the breach,
3. if warranted filing a SAR and
4. providing notice to members of the breach.

Answer 15

True

Question 16

While the required notice to members as part of the data security, response program must include a description of the type of member information that was accessed and a phone number for members to call for further information and assistance. It does not need to include the name of the person who or group that
(the crooks) accessed that information

Answer 16

True

Question 17

Under its data security response program a credit union may contract with its service provider (such as the data processing vendor) to notify all of its members and regulators that it’s information system has been breached

Answer 17

True

Question 18

The children’s online protection program at (COPPA) is a federal law enacted to prohibit, unfair or deceptive Internet acts or practices in connection with the collection, use, and or disclosure of personal information from and about children under the age of 13, who can access the websites via the Internet?

Answer 18

True

Question 19

The COPPA applies to a credit union whose website can be merely accessed by children under age 13

Answer 19

False

Question 20

The COPPA does not require a parental consent if a credit union collects an email address from a child to respond to a request for information that it receives from that child

Answer 20

True

Question 21

If your credit Union plans to collect use and disclose personal information from children under the age of 13, the COPPA, requires your credit union to have a website notice a parental notice and obtain parental consent

Answer 21

True