CCEP Data Privacy Compliance 5

Question 1

Under CCPA as amended by CPRA, which new category of data receives heightened 'sensitive personal information' protections?

Accepted Answer

Social Security numbers and precise geolocation data

Answer

CPRA created a 'sensitive personal information' category that includes Social Security numbers, precise geolocation, racial/ethnic origin, and similar high-risk data, granting consumers the right to limit its use.

Question 2

Which privacy principle requires organizations to be able to demonstrate their compliance with data protection rules, rather than just stating they comply?

Accepted Answer

Accountability

Answer

The accountability principle under GDPR Article 5(2) requires controllers to not only comply with data protection principles but to be able to demonstrate that compliance.

Question 3

An organization processes biometric data to authenticate employees at building entry points. Under GDPR, biometric data processed for unique identification is classified as which type of data?

Accepted Answer

Special category data requiring explicit consent or another Art. 9 basis

Answer

GDPR Article 9 classifies biometric data processed for the purpose of uniquely identifying a natural person as special category data requiring an explicit legal basis from Article 9(2).

Question 4

A US company receives a data subject access request (DSAR) from an EU customer under GDPR. What is the standard deadline for responding?

Accepted Answer

One month, extendable by two additional months for complex requests

Answer

GDPR Article 12(3) requires responding to DSARs within one month of receipt, with the possibility of extending by two additional months for complex or numerous requests after notifying the requester.

Question 5

Which of the following best describes 'Privacy by Design' as a compliance approach?

Accepted Answer

Embedding privacy protections into systems and processes from the earliest design stage

Answer

Privacy by Design, codified in GDPR Article 25, requires integrating data protection into the design of systems and business practices from the outset, not as an afterthought.

(CCEP) Certified Compliance and Ethics Professional Practice Test

(CCEP) Certified Compliance and Ethics Professional Practice Test

CCEP Data Privacy Compliance 5