Privacy Laws and Regulations CDPSE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Under the GDPR, which principle requires that personal data be adequate, relevant, and limited to what is necessary for the purposes for which it is processed?

   • AAccuracy
   • BData minimization
   • CPurpose limitation
   • DStorage limitation
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a key difference between the GDPR and the CCPA/CPRA regarding the legal basis for processing personal data?

   • ANeither law requires a legal basis for processing.
   • BBoth laws require a legal basis for all processing activities.
   • CThe GDPR requires a legal basis for processing, while the CCPA/CPRA is based on consumer opt-out rights.
   • DThe CCPA/CPRA requires a legal basis for processing, while the GDPR is based on consumer opt-out rights.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A data controller processes personal data for a specific purpose. The controller now wants to use the data for a new, unrelated purpose. Under the GDPR, which condition must be met?

   • AThe controller must obtain new consent from the data subject for the new purpose.
   • BThe controller can use the data for any purpose as long as it is within the same organization.
   • CThe controller must anonymize the data before using it for the new purpose.
   • DThe controller can proceed if the new purpose is compatible with the original purpose, as determined by the controller.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is an individual right granted to consumers under the California Consumer Privacy Act (CCPA) as amended by the CPRA?

   • AThe right to restrict processing
   • BThe right to object to automated decision-making
   • CThe right to be forgotten
   • DThe right to data portability
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   A company operates a hospital in the United States and also runs a loyalty program for its patients that collects purchase history. Which privacy law is most likely to apply to the patient health records specifically?

   • AThe Health Insurance Portability and Accountability Act (HIPAA)
   • BThe Family Educational Rights and Privacy Act (FERPA)
   • CThe General Data Protection Regulation (GDPR)
   • DThe California Consumer Privacy Act (CCPA)
   Reveal Solution Discussion Select an answer first