CDPSE Subject Rights 2 — Questions and Answers
Question 1: Under the CCPA, a consumer's right to opt-out applies specifically to which activity?
- Sale of personal information to third parties (Correct answer)
- Internal use of data for analytics
- Processing data for fraud prevention
- Sharing data with service providers under contract
Correct answer: Sale of personal information to third parties
The CCPA's right to opt-out targets the sale of personal information to third parties, not internal processing or contracted service providers.
Question 2: A data subject submits a right-of-access request but cannot verify their identity. What is the organization's best course of action?
- Deny the request immediately and close it
- Request additional identity verification information before fulfilling the request (Correct answer)
- Fulfill the request using any available contact information
- Escalate to law enforcement
Correct answer: Request additional identity verification information before fulfilling the request
Organizations should request additional verification before fulfilling access requests to prevent unauthorized disclosure of personal data.
Question 3: Which GDPR article establishes the right to erasure ('right to be forgotten')?
- Article 15
- Article 16
- Article 17 (Correct answer)
- Article 21
Correct answer: Article 17
GDPR Article 17 establishes the right to erasure, allowing data subjects to request deletion of their personal data under specific conditions.
Question 4: An organization receives a data portability request. In which format must the data be provided?
- PDF only
- A structured, commonly used, machine-readable format (Correct answer)
- Printed hard copy
- Any format chosen by the organization
Correct answer: A structured, commonly used, machine-readable format
GDPR Article 20 requires that data provided for portability be in a structured, commonly used, machine-readable format such as CSV or JSON.
Question 5: Which condition allows an organization to REFUSE a right-to-erasure request under GDPR?
- The data subject has not paid a fee
- The data is necessary for compliance with a legal obligation (Correct answer)
- The data was collected more than two years ago
- The data subject is not an EU resident
Correct answer: The data is necessary for compliance with a legal obligation
GDPR Article 17(3) permits refusal of erasure requests when retention is necessary to comply with a legal obligation.
Question 6: Under the CCPA, how many days does a business have to respond to a verifiable consumer request?
- 30 days
- 45 days (Correct answer)
- 60 days
- 90 days
Correct answer: 45 days
The CCPA requires businesses to respond to verifiable consumer requests within 45 calendar days, extendable by another 45 days with notice.
Question 7: What does the right to restriction of processing allow a data subject to do under GDPR?
- Delete all their personal data permanently
- Limit how the controller uses their data while a dispute is resolved (Correct answer)
- Receive their data in a portable format
- Opt out of automated decision-making
Correct answer: Limit how the controller uses their data while a dispute is resolved
The right to restriction (Article 18) allows data subjects to limit processing of their data, for example while contesting its accuracy.
CDPSE Subject Rights 2
Under the CCPA, a consumer's right to opt-out applies specifically to which activity?