Privacy Laws and Regulations CDPSE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Under the CCPA/CPRA, which of the following is a requirement when a business 'shares' personal information for cross-context behavioral advertising?

   • AConduct a data protection impact assessment (DPIA)
   • BAppoint a data protection officer (DPO)
   • CObtain explicit consent from consumers before sharing
   • DProvide consumers with a right to opt out of the sharing
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   During a compliance assessment, a privacy engineer discovers that the organization does not have a process to respond to consumer requests to delete personal information. Which law is most likely being violated?

   • ANeither law, because deletion is not a required right
   • BThe CCPA/CPRA
   • CBoth the GDPR and the CCPA/CPRA
   • DThe GDPR
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A healthcare provider in the US processes patient data and also handles marketing data for a separate retail division. The provider is subject to HIPAA for patient data and CCPA/CPRA for California residents' marketing data. During a compliance assessment, which gap is most likely to be identified?

   • AStoring patient data and marketing data in the same database without technical segregation.
   • BApplying HIPAA's minimum necessary standard to the retail division's marketing data, which is not required by CCPA/CPRA.
   • CFailing to provide a 'Do Not Sell' link for patient data that is shared with a business associate for treatment purposes.
   • DUsing the same privacy notice for both patient data and marketing data without distinguishing the different rights under HIPAA and CCPA/CPRA.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is the most effective way for an organization to stay informed about changes in privacy laws that may affect its compliance obligations?

   • ASubscribing to regulatory updates from official authorities and industry groups
   • BRelying on internal legal counsel to review laws annually
   • CMonitoring social media for privacy-related news
   • DWaiting for enforcement actions to identify violations
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company is conducting a compliance assessment. It discovers that it processes data of EU residents but has no EU establishment. The company has a DPA with its customers but has not appointed a representative. Which action is most directly required to address this gap?

   • ARely on the DPA with customers to satisfy the representative requirement.
   • BStop processing EU data until a representative is appointed.
   • CAppoint a representative in the EU, as required by Article 27.
   • DEnsure the company's privacy policy includes a contact email for EU data subjects.
   Reveal Solution Discussion Select an answer first