What is the privacy impact rating of an application that stores personally identifiable information, monitors...

The privacy impact rating for an application that stores personally identifiable information (PII), monitors users with ongoing transfers of anonymous data, and changes settings without notifying the user would be P1 high privacy risk. Storing PII already poses a significant risk due to the potential for data breaches and misuse. Monitoring users and transferring data, even if anonymous, increases the risk as it involves ongoing data collection. Changing settings without user notification is a serious privacy concern because it can lead to unauthorized data processing or sharing, further elevating the risk level.

References:

Practical Data Security and Privacy for GDPR and CCPA - ISACA1.

Privacy risk assessment and privacy-preserving data monitoring2.

How To Effectively Monitor Your Privacy Program: A New Series3.