CCPA and CPRA Compliance Flashcards

What is the CPRA's data retention principle that businesses must follow?

Answer: Retain personal information only as long as reasonably necessary for the disclosed purpose

CPRA requires businesses to retain personal information only as long as reasonably necessary and proportionate to the purposes for which it was collected.

Under the CCPA, which category is considered 'sensitive personal information' that triggers additional obligations under CPRA?

Answer: Social Security numbers and precise geolocation data

SSNs and precise geolocation are among the CPRA's defined categories of sensitive personal information with additional use limitation rights.

What right allows California consumers to correct inaccurate personal information held by a business?

Answer: Right to Correct (added by CPRA)

The CPRA introduced the Right to Correct inaccurate personal information, a right not present in the original CCPA.

The CCPA's private right of action is limited to which type of data breach?

Answer: Breaches of non-encrypted or non-redacted personal information due to failure to maintain reasonable security

The CCPA's private right of action applies only to breaches of non-encrypted or non-redacted personal information resulting from failure to implement reasonable security.

Which business practice allows a company to offer financial incentives for consumers to share their personal information under CCPA?

Answer: Financial incentive programs with required notice and opt-in

CCPA allows financial incentive programs for sharing personal information, but businesses must provide conspicuous notice and obtain opt-in consent.

Under the CPRA, what is a 'contractor' as distinct from a 'service provider'?

Answer: An entity that receives personal information pursuant to a written contract but not in the context of providing services to the business

CPRA defines 'contractor' as an entity that receives personal information for business purposes under contract but not in a service-provider relationship.