Certified Information Privacy Technologist: Privacy Regulations and Compliance Practice Flashcards

Under the California Consumer Privacy Act (CCPA), which threshold triggers the law's applicability to a for-profit business?

Answer: Annual gross revenue exceeding $25 million

CCPA applies to for-profit businesses that meet at least one of three thresholds: annual gross revenue exceeding $25 million, buying/selling/receiving/sharing personal information of 100,000+ consumers/households annually, or deriving 50%+ of annual revenue from selling consumers' personal information.

Which GDPR article establishes the right to data portability?

Answer: Article 20

Article 20 of the GDPR grants data subjects the right to receive their personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

A company processes employee health data for workplace safety compliance. Under HIPAA, which entity type classification would typically apply?

Answer: Hybrid entity

A hybrid entity is an organization that performs both covered and non-covered functions; it can designate only its healthcare components as subject to HIPAA requirements.

Under the EU-U.S. Data Privacy Framework, what must a U.S. organization do to legitimately receive personal data transferred from the EU?

Answer: Self-certify with the U.S. Department of Commerce

Organizations must self-certify their adherence to the EU-U.S. Data Privacy Framework Principles with the U.S. Department of Commerce to lawfully receive personal data from EU entities.

Which provision of the Children's Online Privacy Protection Act (COPPA) requires operators to provide notice?

Answer: Operators must post a privacy policy describing their information practices for children under 13

COPPA requires operators of websites or online services directed to children under 13 to post a clear and comprehensive privacy policy describing their information practices.

A financial institution shares customer data with a third-party service provider for marketing purposes. Under the Gramm-Leach-Bliley Act (GLBA), what must customers receive before this sharing occurs?

Answer: A privacy notice with opt-out opportunity

GLBA requires financial institutions to provide customers with a clear privacy notice explaining their information-sharing practices and give customers an opportunity to opt out of sharing with non-affiliated third parties.

Under Virginia's Consumer Data Protection Act (VCDPA), which data processing activity requires a data protection assessment?

Answer: Processing sensitive data or data for targeted advertising

VCDPA requires data protection assessments for processing activities presenting heightened risk, including processing sensitive data, targeted advertising, profiling, and sale of personal data.