CIPP/US: Certified Information Privacy Professional/United StatesDemo

By IAPP · Question Mode

QuestionQ94

State Privacy Laws

A California resident has created an account on your company’s online food-delivery platform and placed several orders over the past month. She later submits a data-subject request to access her personal information under the California Privacy Rights Act.

Assuming the CPRA is in force, which of the following data elements would your company not have to provide to the requester after her identity has been verified?

  • A Inferences made about the individual for the company's internal purposes.
  • B The loyalty account number assigned through the individual's use of the services.
  • C The time stamp for the creation of the individual's account in the platform's database.
  • D The email address submitted by the individual as part of the account registration process.
Explanation

The CPRA access right requires disclosure of specific pieces of personal information obtained from the consumer in response to a verifiable request. Inferences used to create a consumer profile are personal information, and account identifiers and registration email addresses are consumer-associated personal information. A platform database’s account-creation timestamp is system-generated technical or log data, rather than information obtained from the consumer; the CPRA specifically contemplates limiting disclosure of system-log and other technical data that would not be useful to the consumer.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!