I85PREP
⌘ K
US DPO study materials
US DPO study resources

US DPO practice questions

One question at a time. Build your US DPO understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1US Privacy Landscape and Legal Foundations

Which federal agency is the primary enforcer of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules for most covered entities?

  1. The Federal Trade Commission's Bureau of Consumer Protection
  2. The National Institute of Standards and Technology
  3. The Office for Civil Rights (OCR) within the Department of Health and Human Services Correct answer.
  4. The Department of Justice's Civil Rights Division

Explanation

HHS delegated HIPAA enforcement to its Office for Civil Rights, which investigates complaints, conducts compliance reviews, and imposes civil money penalties. NIST publishes guidance but has no enforcement authority, and the FTC's health breach rule applies to vendors not covered by HIPAA.

Question 2US Privacy Landscape and Legal Foundations

Under the California Consumer Privacy Act as amended by the CPRA, which agency is charged with enforcing the law and issuing regulations?

  1. The Federal Trade Commission
  2. The California Privacy Protection Agency Correct answer.
  3. The California Attorney General alone, with no administrative agency
  4. The California Public Utilities Commission

Explanation

The CPRA created the California Privacy Protection Agency, which shares enforcement authority with the Attorney General and has rulemaking power. The CPPA is the first dedicated state privacy regulator in the United States.

Question 3US Privacy Landscape and Legal Foundations

In the CCPA/CPRA framework, what does the term 'sale' of personal information include?

  1. Any transfer of personal information to a service provider under a written contract
  2. Only transfers of personal information to data brokers registered in California
  3. Selling, renting, releasing, disclosing, or transferring personal information for monetary or other valuable consideration Correct answer.
  4. Only exchanges of personal information for monetary payment

Explanation

The CPRA broadened 'sale' to cover disclosure or transfer of personal information for monetary or other valuable consideration, not just cash. Transfers to service providers and contractors under compliant contracts are excluded.

Question 4US Privacy Landscape and Legal Foundations

Which of the following best describes the 'sensitive data' category added by the CPRA?

  1. Data about consumers under the age of 21
  2. A defined set including government identifiers, precise geolocation, racial or ethnic origin, health data, and sexual orientation Correct answer.
  3. Any data about a consumer that the business has not collected directly from the consumer
  4. Only data protected under HIPAA and the Gramm-Leach-Bliley Act

Explanation

The CPRA created a sensitive personal information category that includes identifiers such as Social Security numbers, precise geolocation, racial or ethnic origin, religious beliefs, health information, sex life or sexual orientation, and genetic data. Consumers can limit the use of such data to purposes necessary to perform the service.

Question 5US Privacy Landscape and Legal Foundations

The Virginia Consumer Data Protection Act requires controllers to conduct data protection assessments in which circumstance?

  1. Only when the controller is a state agency
  2. Before processing that presents a heightened risk of harm, such as targeted advertising, sale of personal data, or processing sensitive data Correct answer.
  3. Only when the controller has more than 100,000 consumers
  4. Whenever a consumer requests access to their personal data

Explanation

The VCDPA requires data protection assessments for processing activities presenting heightened risk, including targeted advertising, sale of personal data, profiling with legal or significant effects, and processing sensitive data. Assessments must be documented and provided to the Attorney General on request.

Question 6US Privacy Landscape and Legal Foundations

Under the Colorado Privacy Act, what must a controller do before processing a consumer's sensitive data?

  1. Provide a 90-day opt-out window after processing begins
  2. Obtain the consumer's consent Correct answer.
  3. Publish the data in a public registry
  4. Register with the Colorado Attorney General

Explanation

The CPA requires controllers to obtain consent before processing sensitive data, and to obtain consent from a parent or guardian before processing a known child's data. Consent must be a clear affirmative act.

Question 7US Privacy Landscape and Legal Foundations

Which law is the primary federal statute governing the confidentiality of substance use disorder patient records?

  1. The Health Insurance Portability and Accountability Act
  2. The Fair Credit Reporting Act
  3. The Children's Online Privacy Protection Act
  4. 42 CFR Part 2 Correct answer.

Explanation

42 CFR Part 2 imposes stricter confidentiality rules than HIPAA on federally assisted programs that treat substance use disorders. The 2024 final rule aligned Part 2 more closely with HIPAA while retaining special consent protections.

Question 8US Privacy Landscape and Legal Foundations

The Gramm-Leach-Bliley Act privacy provisions primarily require financial institutions to do which of the following?

  1. Delete all consumer data within 30 days of account closure
  2. Provide privacy notices and allow consumers to opt out of certain sharing with nonaffiliated third parties Correct answer.
  3. Register with the SEC before collecting any consumer data
  4. Obtain affirmative opt-in consent before every disclosure of nonpublic personal information

Explanation

GLBA requires financial institutions to give initial and annual privacy notices and to let consumers opt out of disclosures of nonpublic personal information to nonaffiliated third parties, subject to exceptions. The FTC, CFPB, and banking regulators enforce these provisions.

Question 9US Privacy Landscape and Legal Foundations

Which of the following is the core obligation of the FTC's Safeguards Rule for non-bank financial institutions?

  1. Conduct criminal background checks on all customers
  2. Implement a written information security program with designated qualified individuals, risk assessments, and safeguards Correct answer.
  3. Encrypt all data at rest with a federally approved algorithm only
  4. File annual privacy certifications with Congress

Explanation

The Safeguards Rule requires covered entities to develop, implement, and maintain a comprehensive written information security program. The 2021 amendments added requirements such as a designated qualified individual, periodic risk assessments, access controls, encryption, and incident response plans.

Question 10US Privacy Landscape and Legal Foundations

A company collects personal information from children under 13 through an online service. Which federal statute imposes verifiable parental consent obligations?

  1. The Family Educational Rights and Privacy Act
  2. The Video Privacy Protection Act
  3. The Electronic Communications Privacy Act
  4. The Children's Online Privacy Protection Act Correct answer.

Explanation

COPPA requires operators of websites and online services directed to children under 13, or with actual knowledge of collecting from them, to obtain verifiable parental consent before collecting personal information. The FTC enforces COPPA through its implementing rule.

Question 11US Privacy Landscape and Legal Foundations

Under the Fair Credit Reporting Act, which entity is subject to its obligations regarding consumer reports?

  1. Consumer reporting agencies and users of consumer reports for credit, employment, and other eligibility decisions Correct answer.
  2. Only federally chartered banks
  3. Only companies with more than $10 million in annual revenue
  4. Any business that collects an email address during checkout

Explanation

The FCRA imposes duties on consumer reporting agencies and on users of consumer reports, such as creditors and employers, including permissible purpose and adverse action notice requirements. It also gives consumers rights to dispute and correct information.

Question 12US Privacy Landscape and Legal Foundations

The Driver's Privacy Protection Act restricts the disclosure of which type of information?

  1. Financial records held by banks
  2. Health records maintained by hospitals
  3. Educational records held by universities
  4. Personal information in motor vehicle records held by state DMVs Correct answer.

Explanation

The DPPA limits the disclosure of personal information from state motor vehicle records and permits disclosure only for specified permissible uses. It was enacted after concerns about stalking and privacy abuses involving DMV data.

Question 13US Privacy Landscape and Legal Foundations

Which federal law requires covered entities to notify affected individuals following a breach of unsecured protected health information?

  1. The Sarbanes-Oxley Act
  2. The Stored Communications Act
  3. The HIPAA Breach Notification Rule Correct answer.
  4. The Computer Fraud and Abuse Act

Explanation

The HIPAA Breach Notification Rule requires covered entities to notify affected individuals, HHS, and in some cases the media, following a breach of unsecured PHI. Business associates must notify the covered entity.

Question 14US Privacy Landscape and Legal Foundations

A retail company in Texas collects biometric identifiers from customers. Which law is most directly implicated?

  1. The Illinois Biometric Information Privacy Act
  2. The California Consumer Privacy Act only
  3. The federal Video Privacy Protection Act
  4. The Texas Capture or Use of Biometric Identifier Act Correct answer.

Explanation

Texas has its own biometric privacy statute, the Capture or Use of Biometric Identifier Act, which requires notice and consent before capturing biometric identifiers for commercial purposes. BIPA applies to Illinois, so it would not govern a Texas-based collection activity.

Question 15US Privacy Landscape and Legal Foundations

Under the Illinois Biometric Information Privacy Act, when must an entity obtain written consent before collecting biometric identifiers?

  1. Only after the data has been stored for 30 days
  2. Only if the individual is an employee
  3. Only when the data will be sold to a third party
  4. Before or at the time of collection Correct answer.

Explanation

BIPA requires written notice and written consent before or at the time of collection of biometric identifiers or information. It also requires a publicly available retention and destruction policy. Private rights of action have produced significant litigation.

Question 16US Privacy Landscape and Legal Foundations

Which state enacted the first comprehensive consumer privacy law in the United States?

  1. Virginia
  2. Connecticut
  3. California Correct answer.
  4. Colorado

Explanation

California enacted the CCPA in 2018, making it the first comprehensive state consumer privacy statute in the United States. Virginia, Colorado, and Connecticut followed with their own comprehensive laws in later years.

Question 17US Privacy Landscape and Legal Foundations

What is the primary function of the Privacy Act of 1974?

  1. Protecting children's online privacy
  2. Regulating private-sector data brokers
  3. Governing federal agencies' collection, maintenance, use, and disclosure of records about individuals Correct answer.
  4. Setting standards for credit reporting

Explanation

The Privacy Act of 1974 imposes fair information practice principles on federal agencies, including access and amendment rights and restrictions on disclosure. It applies to systems of records maintained by agencies, not to private businesses.

Question 18US Privacy Landscape and Legal Foundations

Which of the following best describes the role of the FTC Act Section 5 in U.S. privacy enforcement?

  1. It preempts all state privacy laws
  2. It prohibits unfair or deceptive acts or practices, which the FTC uses to challenge misleading privacy statements and unreasonable data security Correct answer.
  3. It creates a comprehensive federal privacy code for all industries
  4. It requires registration of all data brokers with the FTC

Explanation

Section 5 of the FTC Act prohibits unfair or deceptive acts or practices in or affecting commerce, and the FTC has used it to bring privacy and data security enforcement actions. There is no single comprehensive federal privacy statute, so Section 5 fills part of that gap.

Question 19US Privacy Landscape and Legal Foundations

A U.S. company receives a data subject access request from an EU resident under the GDPR. Which statement best describes the likely interplay with U.S. law?

  1. GDPR never applies to U.S. companies
  2. The company must comply with GDPR where it applies, and may also need to satisfy U.S. state law obligations for the same individual Correct answer.
  3. U.S. state privacy laws automatically preempt GDPR
  4. U.S. law prohibits responding to any GDPR request

Explanation

The GDPR can apply extraterritorially to U.S. companies that offer goods or services to EU data subjects or monitor their behavior. U.S. state privacy laws operate alongside GDPR, so a company may face parallel obligations for the same individual.

Question 20US Privacy Landscape and Legal Foundations

What was the primary purpose of the EU-U.S. Data Privacy Framework?

  1. To create a federal privacy agency in the United States
  2. To replace the HIPAA Privacy Rule
  3. To provide a mechanism for lawful transfers of personal data from the EU to certified U.S. organizations Correct answer.
  4. To harmonize all state privacy laws

Explanation

The Data Privacy Framework, adopted in 2023, allows transfers of EU personal data to U.S. organizations that self-certify to the Department of Commerce and commit to the framework's principles. It succeeded the invalidated Privacy Shield.

Question 21US Privacy Landscape and Legal Foundations

Which of the following is a recognized limitation of the HIPAA Privacy Rule's applicability?

  1. It applies to all businesses that handle any personal data
  2. It applies only to covered entities and their business associates, leaving many consumer health apps outside its scope Correct answer.
  3. It applies only to federal agencies
  4. It applies only to paper records

Explanation

HIPAA applies to covered entities such as health plans, clearinghouses, and most providers, plus their business associates. Many direct-to-consumer health apps and wearable devices fall outside that scope, which is why the FTC's Health Breach Notification Rule and state laws can matter.

Question 22US Privacy Landscape and Legal Foundations

Under the CPRA, what right allows a California consumer to direct a business to limit the use and disclosure of sensitive personal information?

  1. The right to data portability
  2. The right to delete
  3. The right to limit use and disclosure of sensitive personal information Correct answer.
  4. The right to non-discrimination

Explanation

The CPRA added the right to limit the use and disclosure of sensitive personal information to purposes necessary to perform the requested goods or services. Businesses must provide a 'Limit the Use of My Sensitive Personal Information' link or an equivalent method.

Question 23US Privacy Landscape and Legal Foundations

Which of the following best characterizes the relationship between state comprehensive privacy laws and sectoral federal laws such as HIPAA?

  1. HIPAA-protected information is generally exempt from many state comprehensive privacy laws, which often defer to HIPAA Correct answer.
  2. State privacy laws always preempt HIPAA
  3. Federal law prohibits states from enacting privacy statutes
  4. State privacy laws apply only to paper records

Explanation

Most state comprehensive privacy laws exempt protected health information governed by HIPAA, avoiding direct conflict with the federal regime. This creates a patchwork in which the same organization may be governed by HIPAA for health data and by state law for other data.

Question 24US Privacy Landscape and Legal Foundations

What does the term 'covered entity' mean under HIPAA?

  1. Any company that processes personal data in the United States
  2. Any vendor that stores data in the cloud
  3. Only a hospital licensed by a state
  4. A health plan, health care clearinghouse, or health care provider that transmits health information electronically in connection with certain transactions Correct answer.

Explanation

HIPAA defines covered entities as health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with standard transactions. Business associates are separate entities that perform functions for or on behalf of covered entities.

Question 25US Privacy Landscape and Legal Foundations

A company's privacy notice states that it does not sell personal data, but the company shares data with an ad network in exchange for audience insights. Under the CCPA/CPRA, what is the most accurate analysis?

  1. The sharing is permitted without restriction because it is disclosed in the privacy notice
  2. The sharing is not a sale because no money changes hands
  3. The sharing is prohibited outright under the CCPA
  4. The sharing may constitute a sale or sharing for cross-context behavioral advertising, triggering opt-out and notice obligations Correct answer.

Explanation

The CPRA defines 'sale' to include disclosure for valuable consideration and separately addresses 'sharing' for cross-context behavioral advertising. Exchanging data for audience insights can qualify, requiring notice, opt-out rights, and honoring opt-out preference signals.

Question 26US Privacy Landscape and Legal Foundations

A California resident exercises the right to delete personal information under the CCPA, as amended by the CPRA. Which set of exceptions may a business rely on to retain the data?

  1. Exceptions such as completing a transaction, detecting security incidents, and complying with legal obligations Correct answer.
  2. No exceptions; deletion must be immediate and absolute in all cases
  3. Only a court order specifically naming the business and the data
  4. Only the consumer's consent, which must be obtained again after the deletion request

Explanation

The CCPA, as amended by the CPRA, lists several exceptions to the right to delete, including completing a transaction, detecting security incidents, and complying with legal obligations. These exceptions allow businesses to retain data for specified purposes even after a verified deletion request. The right is not absolute, and consent is not the sole basis for retention.

Question 27US Privacy Landscape and Legal Foundations

Under the Virginia Consumer Data Protection Act (VCDPA), a controller must conduct a data protection assessment before engaging in which activity?

  1. Collecting a consumer's name and email address for a newsletter
  2. Sending marketing emails to existing customers
  3. Processing personal data for targeted advertising Correct answer.
  4. Sharing personal data with a processor under a written contract

Explanation

The VCDPA requires a data protection assessment for processing activities that present a heightened risk of harm, including targeted advertising, the sale of personal data, and processing sensitive data. Routine collections such as names and emails for a newsletter do not trigger the requirement. Sharing with a processor under contract is also not listed as a triggering activity.

Question 28US Privacy Landscape and Legal Foundations

A Nevada business collects a consumer's name and email address for a newsletter but does not sell personal information. Which obligation applies under the Nevada Privacy of Information Collected on the Internet from Consumers Act?

  1. It must provide a notice describing the categories of covered information collected and how consumers can review and request changes. Correct answer.
  2. It must conduct an annual privacy audit and submit the results to the Attorney General.
  3. It must register with the state as a data broker.
  4. It must obtain opt-in consent before collecting any personal information.

Explanation

The Nevada statute requires operators of commercial websites or online services to post a notice describing the categories of covered information collected and the process for consumers to review and request changes. It does not impose a general opt-in consent requirement for all collection or a data broker registration duty on all businesses. Annual audits are not mandated by this law.

Question 29US Privacy Landscape and Legal Foundations

A company subject to the Gramm-Leach-Bliley Act wants to share nonpublic personal information with a nonaffiliated third party for marketing purposes. Which step is required before the sharing?

  1. File a disclosure statement with the SEC
  2. Conduct a privacy impact assessment and publish the results
  3. Provide a clear and conspicuous opt-out notice and a reasonable opportunity to opt out Correct answer.
  4. Obtain written consent from the consumer for each sharing instance

Explanation

The GLBA privacy rule requires financial institutions to give consumers an initial privacy notice and, before disclosing nonpublic personal information to nonaffiliated third parties, a clear and conspicuous opt-out notice with a reasonable opportunity to opt out. Written consent is not generally required for marketing sharing. SEC filing and public impact assessments are not part of the GLBA notice requirement.

Question 30US Privacy Landscape and Legal Foundations

A Connecticut-based online retailer uses a third-party analytics provider that processes personal data on its behalf. Under the Connecticut Data Privacy Act, which analysis best determines the retailer's obligations regarding a data protection assessment?

  1. No assessment is required because the processor, not the controller, performs the processing.
  2. An assessment is required only if the retailer is a data broker.
  3. An assessment is required only if the data is sold to the processor.
  4. An assessment is required because processing for targeted advertising or profiling presents a heightened risk of harm. Correct answer.

Explanation

The Connecticut Data Privacy Act requires controllers to conduct a data protection assessment for processing activities that present a heightened risk of harm, including targeted advertising and profiling. The obligation rests on the controller even when a processor carries out the processing. The assessment is not limited to sales or to data brokers.

Question 31Sectoral and State Privacy Laws

Under the California Consumer Privacy Act as amended by the CPRA, which consumer right is triggered when a business sells or shares personal information?

  1. The right to receive a paper copy
  2. The right to delete commercial records
  3. The right to opt out of sale or sharing Correct answer.
  4. The right to a jury trial

Explanation

The CPRA added a right to opt out of the sale and sharing of personal information, including cross-context behavioral advertising. Businesses must post a "Do Not Sell or Share My Personal Information" link and honor opt-out preference signals. The other listed rights either do not exist or are not tied to sale or sharing.

Question 32Sectoral and State Privacy Laws

The Colorado Privacy Act applies to a controller that conducts business in Colorado and controls or processes personal data of how many consumers in a calendar year?

  1. 500,000 consumers including employees
  2. 50,000 consumers, regardless of revenue
  3. 100,000 consumers, or derives revenue from selling personal data Correct answer.
  4. 25,000 consumers who are Colorado residents only

Explanation

The CPA threshold is processing personal data of at least 100,000 consumers per calendar year, or deriving revenue from selling personal data. A separate lower trigger of 25,000 consumers applies only where the controller earns revenue from selling personal data. The Act excludes individuals acting in a commercial or employment context from "consumer."

Question 33Sectoral and State Privacy Laws

A Connecticut business collects a consumer's email address to fulfill an online order. Under the Connecticut Data Privacy Act, which obligation applies to this collection?

  1. Provide a reasonably accessible and clear privacy notice before or at collection Correct answer.
  2. Publish the consumer's email address in a public register
  3. Obtain notarized consent from the consumer
  4. Register the processing activity with the Attorney General

Explanation

The CTDPA requires controllers to provide a clear and reasonably accessible privacy notice at or before collection that describes categories of data, purposes, and rights. Notarized consent, AG registration, and public disclosure are not CTDPA requirements. Purpose limitation and data minimization also apply to the collection.

Question 34Sectoral and State Privacy Laws

Under the Utah Consumer Privacy Act, how is the consumer's right to opt out of targeted advertising or sale exercised?

  1. By submitting a request or using an authorized agent or browser signal the controller recognizes Correct answer.
  2. Only by mailing a notarized letter to the controller
  3. Only by calling the Utah Attorney General
  4. Only through a court order

Explanation

The UCPA allows consumers to exercise opt-out rights through a controller-designated channel, an authorized agent, or a recognized browser-based opt-out preference signal. The Act is generally considered the least prescriptive state comprehensive law. Notarization, court orders, and AG calls are not the statutory mechanism.

Question 35Sectoral and State Privacy Laws

The Texas Data Privacy and Security Act exempts which type of entity from its definition of controller?

  1. A large publicly traded retailer
  2. A national bank
  3. A small business as defined by the Small Business Administration Correct answer.
  4. A hospital system

Explanation

The TDPSA exempts small businesses as defined by the SBA from most controller obligations, though they must still obtain consent before selling sensitive data. Financial institutions and HIPAA-covered entities are also excluded through other exemptions. The small-business exemption is a distinctive feature of the Texas law.

Question 36Sectoral and State Privacy Laws

Under the Virginia Consumer Data Protection Act, a controller must conduct a data protection assessment for which activity?

  1. Maintaining an employee directory
  2. Answering a customer service call
  3. Sending a transactional receipt email
  4. Processing personal data for targeted advertising Correct answer.

Explanation

The VCDPA requires data protection assessments for processing that presents heightened risk, including targeted advertising, selling personal data, processing sensitive data, and profiling with legal or significant effects. Routine transactional or administrative processing does not trigger the assessment requirement. The assessment must weigh benefits against consumer rights.

Question 37Sectoral and State Privacy Laws

Which federal sectoral law principally governs the privacy of protected health information held by covered entities and their business associates?

  1. Gramm-Leach-Bliley Act
  2. HIPAA Privacy Rule Correct answer.
  3. COPPA
  4. FERPA

Explanation

The HIPAA Privacy Rule, issued under the Health Insurance Portability and Accountability Act, governs use and disclosure of protected health information by covered entities and business associates. GLBA covers financial institutions, FERPA covers education records, and COPPA covers children's online data. HIPAA also imposes breach notification and security safeguards.

Question 38Sectoral and State Privacy Laws

A fintech company provides consumer loans and must comply with the Gramm-Leach-Bliley Act. Which obligation is most directly required by the GLBA Safeguards Rule?

  1. Publishing a list of all vendors
  2. Obtaining opt-in consent for every marketing email
  3. Maintaining a written information security program with designated responsibility Correct answer.
  4. Filing annual privacy notices with the SEC

Explanation

The GLBA Safeguards Rule requires financial institutions to develop, implement, and maintain a written information security program with a designated qualified individual and periodic risk assessments. Privacy notices are required under the separate Privacy Rule, not the Safeguards Rule. Vendor lists need not be public.

Question 39Sectoral and State Privacy Laws

Under the Children's Online Privacy Protection Act, verifiable parental consent is generally required before a website collects personal information from a child under what age?

  1. 13 Correct answer.
  2. 16
  3. 21
  4. 18

Explanation

COPPA applies to personal information collected online from children under 13 and requires verifiable parental consent before collection, use, or disclosure. The FTC's COPPA Rule specifies acceptable consent methods. Ages 16, 18, and 21 are not the COPPA threshold.

Question 40Sectoral and State Privacy Laws

A company processes biometric identifiers to authenticate employees. Which state statute specifically regulates the collection and retention of biometric identifiers by private entities?

  1. Illinois Biometric Information Privacy Act Correct answer.
  2. California Consumer Privacy Act
  3. New York SHIELD Act
  4. Washington My Health My Data Act

Explanation

BIPA requires written notice, written consent, and a publicly available retention and destruction schedule before collecting biometric identifiers. It provides a private right of action, which has driven significant litigation. The CCPA, My Health My Data Act, and SHIELD Act address other privacy concerns.

Question 41Sectoral and State Privacy Laws

Under the Washington My Health My Data Act, a regulated entity must obtain what before collecting consumer health data?

  1. A court order
  2. Consent separate from the general privacy policy Correct answer.
  3. A federal permit
  4. Approval from a health insurer

Explanation

The MHMDA requires separate consent before collecting or sharing consumer health data, along with a distinct consumer health data privacy policy. It also provides a private right of action under the Consumer Protection Act. Court orders, federal permits, and insurer approvals are not the mechanism.

Question 42Sectoral and State Privacy Laws

Under the New York SHIELD Act, which obligation applies to a person or business that owns or licenses computerized data including private information?

  1. Encrypt all data at rest
  2. Obtain consent before using cookies
  3. Notify affected persons of a breach of private information without unreasonable delay Correct answer.
  4. Register with the Department of Financial Services annually

Explanation

The SHIELD Act expanded New York's breach notification law, requiring notice to affected persons and state authorities when private information is breached. It also requires reasonable security safeguards but does not mandate universal encryption or cookie consent. Annual DFS registration applies to DFS-regulated financial entities, not all businesses.

Question 43Sectoral and State Privacy Laws

Which federal law protects the privacy of education records maintained by institutions that receive federal funds?

  1. GLBA
  2. FERPA Correct answer.
  3. COPPA
  4. HIPAA

Explanation

FERPA protects education records and limits disclosure without consent, with exceptions such as school officials with legitimate educational interests. It applies to institutions receiving federal funding. HIPAA, GLBA, and COPPA govern health, financial, and children's online data respectively.

Question 44Sectoral and State Privacy Laws

The California Age-Appropriate Design Code Act requires covered businesses to do what for online services likely to be accessed by children?

  1. Complete a Data Protection Impact Assessment before offering the service Correct answer.
  2. Register with the FTC
  3. Ban targeted advertising entirely
  4. Obtain parental consent for all users

Explanation

The CAADCA requires a Data Protection Impact Assessment before offering an online service likely to be accessed by children, addressing risks such as targeted advertising and data collection. It also requires default high-privacy settings. It does not ban all advertising or require FTC registration.

Question 45Sectoral and State Privacy Laws

A Florida business covered by the Florida Digital Bill of Rights processes personal data for targeted advertising. What is the primary consumer right implicated?

  1. The right to a jury trial
  2. The right to receive a free credit report
  3. The right to a government-issued ID
  4. The right to opt out of targeted advertising Correct answer.

Explanation

The FDBR grants consumers the right to opt out of targeted advertising, sale of personal data, and profiling. It applies to large companies meeting revenue thresholds. Credit reports, jury trials, and government IDs are unrelated to the Act's consumer rights.

Question 46Sectoral and State Privacy Laws

Under the Oregon Consumer Privacy Act, a controller must provide a consumer, upon request, with which of the following?

  1. A copy of the controller's tax returns
  2. A list of all customers
  3. The home addresses of employees
  4. A list of the specific third parties to whom personal data was disclosed Correct answer.

Explanation

The OCPA uniquely requires controllers to list the specific third parties to whom personal data was disclosed, upon request. This goes beyond the category-level disclosure required by most state laws. Tax returns, employee addresses, and customer lists are not subject to this right.

Question 47Sectoral and State Privacy Laws

Under the California Consumer Privacy Act, a consumer requests deletion of personal information. Which response is most consistent with the statute?

  1. Delete only data collected in the last 30 days
  2. Require the consumer to pay a fee
  3. Refuse all deletion requests to preserve records
  4. Delete the data and direct service providers to delete it, unless an exception applies Correct answer.

Explanation

The CCPA requires businesses to delete personal information and notify service providers and contractors to do the same, subject to statutory exceptions such as legal obligations or completing transactions. Deletion cannot be refused wholesale or limited arbitrarily. Fees cannot be charged for exercising this right.

Question 48Sectoral and State Privacy Laws

In states with comprehensive privacy laws, what is the typical role of an authorized agent in a consumer rights request?

  1. To enforce the law against the business
  2. To override the consumer's own choices
  3. To submit a request on the consumer's behalf with proof of authorization Correct answer.
  4. To set the retention schedule

Explanation

Most state laws allow consumers to use an authorized agent to exercise rights, provided the agent can demonstrate authorization and the controller can verify identity. The agent acts on the consumer's behalf and cannot override the consumer's choices. Enforcement belongs to the attorney general or regulator.

Question 49Sectoral and State Privacy Laws

Which state comprehensive privacy law is generally recognized as the first to take effect in the United States?

  1. California Consumer Privacy Act Correct answer.
  2. Virginia Consumer Data Protection Act
  3. Connecticut Data Privacy Act
  4. Colorado Privacy Act

Explanation

The CCPA took effect on January 1, 2020, making California the first state with a comprehensive consumer privacy law. Virginia, Colorado, and Connecticut followed with laws effective in 2023. The CPRA amended the CCPA effective January 1, 2023.

Question 50Sectoral and State Privacy Laws

Under the Colorado Privacy Act, a controller that processes sensitive data must obtain what from the consumer?

  1. A court order
  2. A credit check
  3. A notarized statement
  4. Consent Correct answer.

Explanation

The CPA requires consent before processing sensitive data, which includes racial or ethnic origin, religious beliefs, health data, sexual orientation, citizenship, genetic or biometric data, and precise geolocation. Consent must be freely given and specific. Notarization, court orders, and credit checks are not required.