Certified Information Privacy Professional Data Breach Notification Laws 2

Question 1

Which type of data is most commonly excluded from triggering state breach notification requirements?

Accepted Answer

Encrypted data where the key was not compromised

Answer

Social Security numbers

Answer

Medical records

Answer

Financial account numbers

Question 2

What is the primary purpose of a 'risk of harm' threshold in breach notification laws?

Accepted Answer

To require notification only when there is meaningful risk of harm to individuals

Answer

To eliminate all notification obligations for companies

Answer

To allow unlimited time before notifying regulators

Answer

To restrict notifications to government agencies only

Question 3

Under FTC authority, breach notification for certain health apps is governed by what rule?

Accepted Answer

Health Breach Notification Rule

Answer

HIPAA Privacy Rule

Answer

CCPA Regulations

Answer

GLBA Safeguards Rule

Question 4

Which notification recipient is often required when a breach affects 500 or more residents of a single state?

Accepted Answer

Prominent media outlets in that state

Answer

The FBI

Answer

The US Congress

Answer

All US state attorneys general simultaneously

Question 5

What does the term 'personal information' most commonly refer to in US state breach notification laws?

Accepted Answer

Name combined with SSN, financial account, or medical information

Answer

Any name or address alone

Answer

Only biometric data

Answer

Solely government-issued ID numbers

Question 6

Which best describes a 'substitute notice' under state breach notification laws?

Accepted Answer

Notice via website posting and statewide media when direct contact is too costly

Answer

A notice sent to a substitute address when the primary address is unknown

Answer

An internal memo circulated among employees

Answer

A notice sent only to credit bureaus