Exam CIPP-US All QuestionsBrowse all questions from this exam
Go to Exam
Question 124

SCENARIO -

Please use the following to answer the next question:

Otto is preparing a report to his Board of Directors at Filtration Station, where he is responsible for the privacy program. Filtration Station is a U.S. company that sells filters and tubing products to pharmaceutical companies for research use. The company is based in Seattle, Washington, with offices throughout the U.S. and Asia. It sells to business customers across both the U.S. and the Asia-Pacific region. Filtration Station participates in the Cross-Border Privacy Rules system of the APEC Privacy Framework.

Unfortunately, Filtration Station suffered a data breach in the previous quarter. An unknown third party was able to gain access to Filtration Station’s network and was able to steal data relating to employees in the company’s Human Resources database, which is hosted by a third-party cloud provider based in the U.S. The HR data is encrypted. Filtration Station also uses the third-party cloud provider to host its business marketing contact database. The marketing database was not affected by the data breach. It appears that the data breach was caused when a system administrator at the cloud provider stored the encryption keys with the data itself.

The Board has asked Otto to provide information about the data breach and how updates on new developments in privacy laws and regulations apply to Filtration Station. They are particularly concerned about staying up to date on the various U.S. state laws and regulations that have been in the news, especially the California Consumer Privacy Act (CCPA) and breach notification requirements.

The Board has asked Otto whether the company will need to comply with the new California Consumer Privacy Law (CCPA). What should Otto tell the Board?

    Correct Answer: C

    Business contact information could be considered personal information governed by the California Consumer Privacy Act (CCPA). The CCPA broadly defines personal information to include any information that can be associated with or linked to a particular individual, including business contact details. Thus, companies that handle such information, even if they are not based in California, are required to comply with the CCPA if they meet certain thresholds regarding business size and data handling practices.

Discussion
smp175Option: C

CCPA applies regardless of enforcement. Under the CPRA, which amended the CCPA, business contact information is PII.

7cae8a8Option: C

Prompt answer is ridiculous. These need to seriously be updated. It's C.

BhimeshOption: C

Are work email addresses and business contact information governed by the CCPA? The CCPA applies to the “personal information” of individuals that reside in the state of California. The Act also provides a non-exhaustive list of examples of personal information which includes “employment,” as well as “professional or employment-related information. The net result is that work email addresses that contain an employee’s name or business contact information, such as the employee’s name, job title, company, business address, work phone number, etc. are arguably covered within the definition of “personal information.” The term “personal information” is defined broadly as including any information that “relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular” California resident.

RomeoktonOption: C

The prompted answer is ridiculous.