CIPP IAPP 2

Question 1

Under the California Consumer Privacy Act (CCPA), which threshold triggers a business's obligation to comply?

Accepted Answer

Annual gross revenues exceeding $25 million, buying/selling data of 100,000+ consumers, or deriving 50%+ revenue from selling data

Answer

CCPA applies to for-profit businesses meeting at least one of three thresholds: $25M revenue, 100,000+ consumer records, or 50%+ revenue from selling personal information.

Question 2

Which federal law establishes a framework for protecting the privacy of student education records?

Accepted Answer

FERPA

Answer

FERPA (Family Educational Rights and Privacy Act) protects the privacy of student education records and grants parents and eligible students rights over those records.

Question 3

A company collects data for marketing and then uses it for fraud detection. Under FTC principles, this most likely violates which concept?

Accepted Answer

Purpose limitation

Answer

Purpose limitation requires that data collected for one stated purpose not be used for incompatible secondary purposes without notice and consent.

Question 4

Which US law requires financial institutions to explain their information-sharing practices and give customers the right to opt out of certain sharing?

Accepted Answer

GLBA Privacy Rule

Answer

The Gramm-Leach-Bliley Act (GLBA) Privacy Rule requires financial institutions to provide privacy notices and opt-out rights regarding nonpublic personal information sharing with non-affiliated third parties.

Question 5

The HIPAA minimum necessary standard requires covered entities to:

Accepted Answer

Limit PHI access and disclosure to only what is needed for the intended purpose

Answer

The minimum necessary standard requires covered entities to make reasonable efforts to limit PHI use, disclosure, and requests to the minimum needed to accomplish the intended purpose.

Certified Information Privacy Professional Practice Test

Certified Information Privacy Professional Practice Test

CIPP IAPP 2