Certified Information Privacy Professional CCPA and CPRA Compliance 2

Question 1

What is the CPRA's data retention principle that businesses must follow?

Accepted Answer

Retain personal information only as long as reasonably necessary for the disclosed purpose

Answer

CPRA requires businesses to retain personal information only as long as reasonably necessary and proportionate to the purposes for which it was collected.

Question 2

Under the CCPA, which category is considered 'sensitive personal information' that triggers additional obligations under CPRA?

Accepted Answer

Social Security numbers and precise geolocation data

Answer

SSNs and precise geolocation are among the CPRA's defined categories of sensitive personal information with additional use limitation rights.

Question 3

What right allows California consumers to correct inaccurate personal information held by a business?

Accepted Answer

Right to Correct (added by CPRA)

Answer

The CPRA introduced the Right to Correct inaccurate personal information, a right not present in the original CCPA.

Question 4

The CCPA's private right of action is limited to which type of data breach?

Accepted Answer

Breaches of non-encrypted or non-redacted personal information due to failure to maintain reasonable security

Answer

The CCPA's private right of action applies only to breaches of non-encrypted or non-redacted personal information resulting from failure to implement reasonable security.

Question 5

Which business practice allows a company to offer financial incentives for consumers to share their personal information under CCPA?

Accepted Answer

Financial incentive programs with required notice and opt-in

Answer

CCPA allows financial incentive programs for sharing personal information, but businesses must provide conspicuous notice and obtain opt-in consent.

Certified Information Privacy Professional Practice Test

Certified Information Privacy Professional Practice Test

Certified Information Privacy Professional CCPA and CPRA Compliance 2