What is the difference between confidential information and sensitive personal data?

• A. Confidential information is public data; sensitive data include race and religion
• B. Confidential information can be shared freely; sensitive data are illegal to store
• C. Confidential information is private personal data; sensitive personal data include health, race, religion, sexual orientation, and criminal history, requiring higher protection and stricter processing rules
• D. There is no difference; both are treated the same

Answer: (C)

Think about how privacy protections differ for general private information versus a special, highly protected category. Confidential information is anything kept private or secret because of trust, policy, or confidentiality obligations. It can encompass private personal data but isn’t defined by a specific legal category with its own strict rules.

Sensitive personal data, on the other hand, is a defined subset of personal data that requires extra safeguards. This includes health information, race or ethnicity, religion, sexual orientation, and criminal history. Because disclosing this kind of data can cause significant harm, laws require higher protection and stricter processing rules—things like stronger consent requirements, purpose limitations, minimization, and robust security measures.

So the best answer aligns with the idea that confidential information relates to private data that should be kept private, while sensitive personal data are the special category of data needing heightened protection and stricter handling. The other options misstate the level of protection or the nature of confidentiality, which is why they’re not correct. Practical takeaway: when handling personal data, always assess whether it falls into the sensitive category to apply the appropriate, stronger safeguards.