CCPA and CPRA Compliance Flashcards

What must a business's privacy notice include under the CCPA 'notice at collection' requirement?

Answer: Categories of personal information collected and the purposes for collection

CCPA requires that businesses provide notice at collection disclosing the categories of personal information collected and the purposes for which they will be used.

Under CCPA, how long does a business have to respond to a verifiable consumer request to know or delete?

Answer: 45 days, extendable by another 45 days with notice

Businesses have 45 days to respond to verifiable consumer requests, with the ability to extend by an additional 45 days if they notify the consumer.

Which CPRA provision requires businesses to conduct risk assessments before undertaking high-risk processing activities?

Answer: Privacy risk assessment (DPIA-like) requirement for high-risk processing

CPRA requires businesses to conduct privacy risk assessments before processing activities that present significant risk to consumers' privacy, similar to GDPR's DPIAs.

The CCPA applies to for-profit businesses that buy, receive, or sell personal information of how many California consumers annually?

Answer: 100,000 or more consumers or households

One of the three CCPA thresholds is buying, receiving, selling, or sharing personal information of 100,000 or more California consumers or households annually.

Under CCPA's non-discrimination provision, businesses cannot penalize consumers for exercising their privacy rights UNLESS they:

Answer: Offer a financially-valued program that requires personal information to provide the service

CCPA's anti-discrimination provision has an exception for bona fide financial incentive programs where the personal information is reasonably related to the value of the program.

What CPRA requirement applies to businesses that engage in 'profiling' consumers in ways that significantly affect them?

Answer: Right to opt out of automated decision-making and profiling

CPRA gives consumers the right to opt out of and to know about automated decision-making and profiling where it produces significant effects.