CIPP/US: Certified Information Privacy Professional/United StatesDemo

By IAPP · Question Mode

QuestionQ199

State Privacy Laws

Privacy Is Hiring Inc., a California-based company, is an online specialty recruiting firm that focuses on placing privacy professionals in positions at major companies. Job candidates build online profiles describing their experience and credentials and may pay $19.99/month by credit card to promote their profiles to prospective employers. Privacy Is Hiring Inc. stores all customer data at rest in encrypted form on its servers.

In what circumstances would Privacy Is Hiring Inc. need to notify affected individuals after a data breach?

  • A If law enforcement has completed its investigation and has authorized Privacy Is Hiring Inc. to provide the notification to clients and applicable regulators.
  • B If the job candidates’ credit card information and the encryption keys were among the information taken.
  • C If Privacy Is Hiring Inc., reasonably believes that job candidates will be harmed by the data breach.
  • D If the personal information stolen included the individuals’ names and credit card pin numbers.
Explanation

California Civil Code § 1798.82 requires breach notification when encrypted personal information is acquired by an unauthorized person and the encryption key or security credential is also acquired, if the business reasonably believes that key or credential could make the information readable or usable. Compromise of both the candidates’ credit-card information and the encryption keys therefore triggers notification despite encryption at rest.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!