CSL Data Protection & Privacy Laws 2

Question 1

Under the California Consumer Privacy Act (CCPA), which threshold triggers a business's compliance obligations based on annual gross revenue?

Accepted Answer

$25 million

Answer

The CCPA applies to for-profit businesses with annual gross revenues exceeding $25 million.

Question 2

The Health Insurance Portability and Accountability Act (HIPAA) Security Rule specifically governs which type of health information?

Accepted Answer

Electronic protected health information (ePHI) only

Answer

The HIPAA Security Rule applies exclusively to electronic protected health information (ePHI), while the Privacy Rule covers all PHI formats.

Question 3

Which EU GDPR principle requires that personal data be collected only for specified, explicit, and legitimate purposes?

Accepted Answer

Purpose limitation

Answer

Purpose limitation under GDPR Article 5(1)(b) restricts data use to the specific purposes for which it was originally collected.

Question 4

A U.S. company transfers personal data of EU residents to its servers in Texas. Under GDPR, what must the company ensure?

Accepted Answer

The transfer complies with a lawful transfer mechanism such as Standard Contractual Clauses

Answer

GDPR Chapter V requires that international data transfers use approved mechanisms like Standard Contractual Clauses (SCCs) or adequacy decisions.

Question 5

The Gramm-Leach-Bliley Act (GLBA) Safeguards Rule primarily applies to which category of organizations?

Accepted Answer

Financial institutions offering consumer financial products or services

Answer

The GLBA Safeguards Rule requires financial institutions to protect the security and confidentiality of customers' nonpublic personal information.

(CSL) Cybersecurity Law Certification Practice Test