Certified Information Privacy Professional CCPA and CPRA Compliance 1 — Questions and Answers
Question 1: Which entity established by the CPRA is responsible for enforcing California privacy law and issuing regulations?
- California Privacy Protection Agency (CPPA) (Correct answer)
- California Department of Justice
- California Consumer Protection Bureau
- Federal Trade Commission
Correct answer: California Privacy Protection Agency (CPPA)
The CPRA created the California Privacy Protection Agency (CPPA), the first US dedicated state privacy enforcement agency with rulemaking authority.
Question 2: Under the CCPA, what is the definition of 'sale' of personal information?
- Disclosing personal information for monetary or other valuable consideration (Correct answer)
- Only cash transactions involving personal data
- Sharing data within the same corporate family
- Any internal use of consumer data
Correct answer: Disclosing personal information for monetary or other valuable consideration
CCPA defines 'sale' broadly to include disclosing personal information for monetary or other valuable consideration, not just cash transactions.
Question 3: What right did the CPRA add to the CCPA that allows consumers to limit use of their sensitive personal information?
- Right to Limit Use of Sensitive Personal Information (Correct answer)
- Right to Erasure
- Right to Data Portability
- Right to Non-Discrimination
Correct answer: Right to Limit Use of Sensitive Personal Information
The CPRA introduced the Right to Limit Use and Disclosure of Sensitive Personal Information, allowing consumers to restrict how businesses use their sensitive data.
Question 4: Which threshold makes a business subject to the CCPA/CPRA based on revenue?
- Annual gross revenues exceeding $25 million (Correct answer)
- Annual gross revenues exceeding $10 million
- Annual gross revenues exceeding $1 million
- Annual gross revenues exceeding $100 million
Correct answer: Annual gross revenues exceeding $25 million
Businesses with annual gross revenues exceeding $25 million that meet other conditions are subject to CCPA/CPRA requirements.
Question 5: The CPRA strengthened opt-out rights by expanding the concept of 'sale' to also include what?
- Sharing personal information for cross-context behavioral advertising (Correct answer)
- Internal analytics uses
- Sharing within wholly-owned subsidiaries
- All business transfers
Correct answer: Sharing personal information for cross-context behavioral advertising
The CPRA added 'sharing' personal information for cross-context behavioral advertising as a separate opt-out right, covering data shared for targeted advertising without money changing hands.
Question 6: Under the CCPA, consumers must be given a 'Do Not Sell My Personal Information' link on the business's website. What did the CPRA change this to?
- 'Do Not Sell or Share My Personal Information' (Correct answer)
- 'Opt Out of All Data Processing'
- 'Delete My Data'
- 'Do Not Track Me'
Correct answer: 'Do Not Sell or Share My Personal Information'
The CPRA amended the required opt-out link to read 'Do Not Sell or Share My Personal Information' to reflect the new opt-out right for sharing.
Certified Information Privacy Professional CCPA and CPRA Compliance 1
Which entity established by the CPRA is responsible for enforcing California privacy law and issuing regulations?