Privacy Laws and Regulations CDPSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company collects customer data for order processing. It also uses the same data for marketing without informing customers. Under the CCPA/CPRA, which right is most directly violated?

   • AThe right to opt out of the sale of personal information.
   • BThe right to non-discrimination for exercising privacy rights.
   • CThe right to delete personal information.
   • DThe right to know what personal information is collected and how it is used.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Brazilian company processes data of Brazilian residents and also has a small number of customers in Argentina. The company has no establishment in the EU. Which law(s) apply to the company's processing?

   • ALGPD only, because the company is Brazilian and processes data of Brazilian residents.
   • BGDPR, because the company processes data of individuals in South America.
   • CLGPD and Argentina's data protection law, because the company processes data of residents in both countries.
   • DNo law applies because the company is not in the EU.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A privacy officer at a global company is responsible for tracking regulatory changes. The company operates in the EU, Brazil, and Japan. Which approach is most effective for ensuring ongoing compliance?

   • ARely on the legal department to inform the privacy team of any changes, as they are the sole source of regulatory updates.
   • BReview the company's privacy policies annually, regardless of external changes.
   • CSubscribe to official regulatory newsletters and participate in industry working groups to stay informed of changes.
   • DWait for a regulatory enforcement action to identify non-compliance before making changes.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A multinational company operates in both the EU and California. It processes HR data of employees in both regions. Which of the following is a key difference in how the GDPR and CCPA/CPRA treat employee data?

   • AGDPR requires employee consent for all HR processing, while CCPA/CPRA requires consent for all employee data sales.
   • BGDPR has a specific legal basis for employment processing, while CCPA/CPRA treats employee data with fewer restrictions than consumer data.
   • CGDPR requires a legal basis for processing employee data, while CCPA/CPRA does not require a legal basis for any processing.
   • DGDPR provides employees with the right to access their data, while CCPA/CPRA does not provide any rights to employees.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A US-based e-commerce company with no physical presence in the EU sells digital goods to customers worldwide, including EU residents. The company uses a third-party payment processor in the US and stores customer data in AWS US-East. The company has no employees or offices in the EU. Under the GDPR, which action is most directly required for the company's processing of EU customer data?

   • AEnsure the payment processor signs a data processing agreement, which fully satisfies all GDPR obligations for the company.
   • BStore all EU customer data in an EU region to comply with data localization requirements under the GDPR.
   • CCease all processing of EU data because the company has no EU establishment and therefore cannot lawfully process EU personal data.
   • DAppoint a representative in the EU, as the company is offering goods to EU data subjects even without an establishment there.
   Reveal Solution Discussion Select an answer first