Discuss IAPP CIPP/US Exam Topic 2 Question 77

SCENARIO

Please use the following to answer the next QUESTION

Otto is preparing a report to his Board of Directors at Filtration Station, where he is responsible for the privacy program. Filtration Station is a U.S. company that sells filters and tubing products to pharmaceutical companies for research use. The company is based in Seattle, Washington, with offices throughout the U.S. and Asi

a. It sells to business customers across both the U.S. and the Asia-Pacific region. Filtration Station participates in the Cross-Border Privacy Rules system of the APEC Privacy Framework.

Unfortunately, Filtration Station suffered a data breach in the previous quarter. An unknown third party was able

to gain access to Filtration Station's network and was able to steal data relating to employees in the company's Human Resources database, which is hosted by a third-party cloud provider based in the U.S. The HR data is encrypted. Filtration Station also uses the third-party cloud provider to host its business marketing contact database. The marketing database was not affected by the data breach. It appears that the data breach was caused when a system administrator at the cloud provider stored the encryption keys with the data itself.

The Board has asked Otto to provide information about the data breach and how updates on new developments in privacy laws and regulations apply to Filtration Station. They are particularly concerned about staying up to date on the various U.S. state laws and regulations that have been in the news, especially the California Consumer Privacy Act (CCPA) and breach notification requirements.

The Board has asked Otto whether the company will need to comply with the new California Consumer Privacy Law (CCPA). What should Otto tell the Board?

AThat CCPA will apply to the company only after the California Attorney General determines that it will enforce the statute.

BThat the company is governed by CCPA, but does not need to take any additional steps because it follows CPBR.

CThat business contact information could be considered personal information governed by CCPA.

DThat CCPA only applies to companies based in California, which exempts the company from compliance.

Suggested Answer: D

The Colorado Privacy Act (CPA) grants consumers the right to access, correct, or delete their personal data, including sensitive data, that is processed by a controller1.Sensitive data is defined as personal data that reveals racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life or sexual orientation, citizenship or citizenship status, genetic or biometric data, or personal data from a known child2.The CPA also grants consumers the right to opt out of the processing of their personal data for purposes of targeted advertising, the sale of personal data, or certain kinds of profiling3. However, the CPA does not grant consumers the right to limit the use of sensitive data for other purposes, such as providing a product or service requested by the consumer, complying with legal obligations, or protecting the vital interests of the consumer or another person.Therefore, option D is the correct answer, as it is not a privacy right available under the CPA.Reference:1:Colorado Privacy Act (CPA) - Colorado Attorney General2:Protect Personal Data Privacy | Colorado General Assembly3:SENATE BILL 21-190 Woodward, Garcia; PRIVACY. COLORADO PRIVACY ACT ...: Colorado Privacy Act: What You Need to Know | OneTrust DataGuidance

Get Premium CIPP/US Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

40 comments · newest first

Brandon 10 months ago

Isn't it weird that the breach happened due to poor key management?

Ezekiel 11 months ago

I think they should definitely consider the implications of CCPA.

Lorita 11 months ago

Wait, so business contact info might be personal info? That sounds a bit off.

Theola 11 months ago

CCPA applies to any business that serves California residents, not just CA-based companies.

Glenn 11 months ago

Totally agree! They need to be compliant regardless of where they're based.

Svetlana 11 months ago

I recall that the CCPA has specific thresholds for compliance, so I’m not convinced that just being outside California exempts them completely.

Armando 12 months ago

I practiced a question about whether business contact info counts as personal data under CCPA, and I think that could be relevant for Otto's report.

Arleen 12 months ago

I’m a bit unsure, but I think the CCPA could apply to Filtration Station since they deal with personal data, even if they’re based in Washington.

Agustin 1 year ago

I remember discussing how the CCPA applies to businesses outside California if they meet certain criteria, so I think Otto needs to clarify that point.

Salena 1 year ago

Okay, I think I've got a handle on this. The company is based in Seattle, but it sells to customers in the U.S. and Asia-Pacific region. The CCPA is a California law, so it would only apply to the company's California-based operations, if any. Since the question doesn't mention any California-based offices or customers, I'm leaning towards the answer that the CCPA doesn't apply to this company.

Emiko 1 year ago

This seems like a tricky one. The company had a data breach, which could trigger certain notification requirements under the CCPA. But the question is specifically asking about whether the CCPA applies to the company in the first place. I'll need to really focus on the details about the company's operations and location to determine if they fall under the CCPA's jurisdiction.

Cathrine 1 year ago

I think the key here is that the company participates in the APEC Cross-Border Privacy Rules system. That might mean they're already following certain privacy standards that could overlap with the CCPA. I'd want to look into how the CCPA interacts with other privacy frameworks like APEC CBPR.

Mona 1 year ago

Okay, let's see here. The company is based in Seattle, Washington, but it sells to customers in the U.S. and Asia-Pacific region. The CCPA is a California law, so I'm not sure if it would apply to this company. I'll need to look into the specific requirements of the CCPA to determine if Filtration Station needs to comply.

Freeman 1 year ago

I'm not entirely sure about this one. The question seems to be focused on the CCPA, but there are a lot of details about the company and the data breach that could be relevant. I'll need to carefully read through the scenario and think about how the CCPA might apply.

Elise 1 year ago

Wow, imagine trying to keep up with all these privacy laws. Filtration Station should just move to a desert island and forget about the whole thing.

Joesph 1 year ago

↳ replying to Elise

I agree, it must be overwhelming to stay on top of all these regulations.

Skye 1 year ago

↳ replying to Elise

C) That business contact information could be considered personal information governed by CCPA.

Judy 1 year ago

↳ replying to Elise

A) That CCPA will apply to the company only after the California Attorney General determines that it will enforce the statute.

Brittani 1 year ago

I'm going with C. The HR data breach seems to have exposed personal information, and CCPA has a broad definition of what counts as personal data. Better safe than sorry, right?

Fletcher 1 year ago

↳ replying to Brittani

Definitely, especially with all the recent data privacy regulations.

Vallie 1 year ago

↳ replying to Brittani

I agree, it's better to err on the side of caution when it comes to personal data.

Jaclyn 1 year ago

↳ replying to Brittani

Leota 1 year ago

↳ replying to Brittani

Tanesha 2 years ago

Ha! Filtration Station should be glad they're not based in California. D seems like the easiest way out of this compliance headache.

Dominque 1 year ago

↳ replying to Tanesha

D) That CCPA only applies to companies based in California, which exempts the company from compliance.

Kristine 1 year ago

↳ replying to Tanesha

Ha! Filtration Station should be glad they're not based in California. D seems like the easiest way out of this compliance headache.

Mari 1 year ago

↳ replying to Tanesha

A) That CCPA will apply to the company only after the California Attorney General determines that it will enforce the statute.

Nana 2 years ago

I think Otto should also mention that business contact information could be considered personal information governed by CCPA.

Fletcher 2 years ago

I agree with Bronwyn. It's important for the company to stay informed about the latest privacy laws and regulations.

Bronwyn 2 years ago

I think Otto should tell the Board that CCPA will apply to the company only after the California Attorney General determines that it will enforce the statute.

Owen 2 years ago

Hmm, I'm not sure. Does the fact that Filtration Station is based in Seattle mean it's exempt from CCPA? The question is a bit ambiguous.

Emilio 1 year ago

↳ replying to Owen

Yes, I agree. Business contact information could fall under CCPA regulations.

Lajuana 1 year ago

↳ replying to Owen

C) That business contact information could be considered personal information governed by CCPA.

Ciara 1 year ago

↳ replying to Owen

Hmm, I think that makes sense. The location of the company might not exempt it from CCPA.

Lilli 1 year ago

↳ replying to Owen

A) That CCPA will apply to the company only after the California Attorney General determines that it will enforce the statute.

Ollie 1 year ago

↳ replying to Owen

Yes, I agree. Business contact information could fall under CCPA regulations.

Ressie 1 year ago

↳ replying to Owen

C) That business contact information could be considered personal information governed by CCPA.

Bonita 1 year ago

↳ replying to Owen

Hmm, I think that makes sense. The location of the company might not exempt it from CCPA.

Tawna 2 years ago

↳ replying to Owen

A) That CCPA will apply to the company only after the California Attorney General determines that it will enforce the statute.

Ceola 2 years ago

I think the correct answer is C. The breach affected employee data, which could be considered personal information under CCPA. The company should review its CCPA compliance regardless of its participation in CPBR.

IAPP CIPP/US Exam - Topic 2 Question 77 Discussion