What is the privacy impact rating of an application that stores personally identifiable information, monitors users with ongoing transfers of…

The application's behavior aligns with the definition of a high privacy risk. It stores personally identifiable information (PII), which is a primary factor in risk assessment. Furthermore, it actively monitors users and changes system settings without user notification or consent. This combination of sensitive data handling, intrusive monitoring, and lack of user control represents a significant potential for harm, such as identity theft or loss of autonomy. Industry-standard frameworks, like the Microsoft Security Development Lifecycle (SDL), classify such applications as having the highest privacy risk rating (P1) due to these specific characteristics.

B. P2 moderate privacy risk: This is incorrect because the risk is elevated beyond moderate due to the combination of storing PII and making unauthorized changes to user settings without consent.

C. P3 low privacy risk: This is incorrect as any application that stores and processes PII cannot be classified as low risk, especially when combined with active monitoring.

D. P4 no privacy risk: This is incorrect because the application performs multiple actions—storing PII, monitoring, and changing settings—that explicitly create significant and undeniable privacy risks.

---

1. Microsoft Corporation. (2012). The Security Development Lifecycle: A Process for Developing Demonstrably More Secure Software. Microsoft Press. In Chapter 11, "Stage 9: The Final Security Review," the privacy rating system is detailed. A P1 (High Privacy Risk) rating is assigned to features that "store or transfer PII; change settings or file-type associations; or install software," all of which are described in the question's scenario.

2. Microsoft. (n.d.). Microsoft SDL Practice #10: Perform Privacy Assessment. Microsoft Security Development Lifecycle Documentation. Retrieved from official Microsoft SDL guidance. The documentation specifies that a Privacy Impact Rating of P1 (High) is warranted when a feature stores or transfers PII or makes changes that could affect a user's privacy without their awareness or consent.

3. National Institute of Standards and Technology (NIST). (2010). NIST Special Publication 800-122: Guide to Protecting the Confidentiality of Personally Identifiable Information (PII). In Section 3.3, "Impact Level," the guide defines a high-impact PII confidentiality breach as one that could result in "significant harm to individuals," including financial loss or identity theft. The application's described behavior creates conditions for such a high-impact event.

4. Solove, D. J., & Hartzog, W. (2014). The FTC and the New Common Law of Privacy. Columbia Law Review, 114(3), 583-676. This academic publication discusses privacy harms, noting that lack of transparency and user control (e.g., changing settings without notice) are key factors that regulatory bodies like the FTC consider when assessing the severity of a privacy violation (p. 605-607).