Certified Information Privacy Professional Data Breach Notification Laws 2

Question 1

Which type of data is most commonly excluded from triggering state breach notification requirements?

Accepted Answer

Encrypted data where the key was not compromised

Answer

Most state breach notification laws include a safe harbor for encrypted data when the encryption key was not also compromised in the breach.

Question 2

What is the primary purpose of a 'risk of harm' threshold in breach notification laws?

Accepted Answer

To require notification only when there is meaningful risk of harm to individuals

Answer

Risk of harm thresholds help ensure notification obligations are triggered only when the breach poses meaningful risk to individuals, reducing unnecessary notifications.

Question 3

Under FTC authority, breach notification for certain health apps is governed by what rule?

Accepted Answer

Health Breach Notification Rule

Answer

The FTC's Health Breach Notification Rule covers vendors of personal health records and related entities not covered by HIPAA.

Question 4

Which notification recipient is often required when a breach affects 500 or more residents of a single state?

Accepted Answer

Prominent media outlets in that state

Answer

HIPAA requires notifying prominent media outlets serving a state or jurisdiction when a breach affects 500 or more residents of that state.

Question 5

What does the term 'personal information' most commonly refer to in US state breach notification laws?

Accepted Answer

Name combined with SSN, financial account, or medical information

Answer

Most state laws define personal information as an individual's name combined with sensitive identifiers like SSN, financial account numbers, or medical data.

Certified Information Privacy Professional Practice Test

Certified Information Privacy Professional Practice Test

Certified Information Privacy Professional Data Breach Notification Laws 2