CIPP/US: Certified Information Privacy Professional/United StatesDemo

By IAPP · Question Mode

QuestionQ237

State Privacy Laws

Crashpuppy would need to determine whether the data affected in the “Applicant Incident” is covered by state data privacy and security laws, such as the California Privacy Rights Act (CPRA) or the Colorado Privacy Act (CPA). All of the following would assist in making that determination EXCEPT?

  • A Crashpuppy’s policy on selling applicant information
  • B Crashpuppy’s status as a government contractor
  • C Crashpuppy’s legal entity structure
  • D Crashpuppy’s annual revenue
Explanation

CPRA applicability can depend on annual gross revenue, whether at least 50% of annual revenue is derived from selling or sharing personal information, and whether a commonly controlled, commonly branded entity shares consumers’ personal information. The CPA also applies thresholds based on a legal entity’s processing of consumer data or revenue from selling personal data. Being a government contractor does not, by itself, establish coverage or an exemption under these statutes; exemptions for government bodies apply to governmental entities rather than a private contractor merely because it contracts with one.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!