RCC RCC Data Privacy and Information Security Compliance 1 — Questions and Answers
Question 1: Under the California Consumer Privacy Act (CCPA), consumers have the right to:
- Delete all records held by a business at any time regardless of law
- Know what personal information is collected about them and request its deletion (Correct answer)
- Prohibit businesses from collecting any data
- Sue businesses for any data collection without prior notice
Correct answer: Know what personal information is collected about them and request its deletion
The CCPA grants California consumers rights to know about, access, delete, and opt out of the sale of their personal information, with some exceptions.
Question 2: Which US federal law governs the privacy of student educational records?
- HIPAA
- FERPA (Family Educational Rights and Privacy Act) (Correct answer)
- GLBA
- COPPA
Correct answer: FERPA (Family Educational Rights and Privacy Act)
FERPA protects the privacy of student education records and grants parents and eligible students rights to access and control those records.
Question 3: A 'data breach notification' requirement typically obligates an organization to:
- Notify only the affected individuals within one year
- Notify affected individuals and relevant authorities within a specified timeframe after discovering a breach (Correct answer)
- Conduct an internal investigation and keep results confidential
- Pay a fixed regulatory fine without further obligation
Correct answer: Notify affected individuals and relevant authorities within a specified timeframe after discovering a breach
Most US state data breach laws and sector-specific regulations require timely notification to affected individuals and, in many cases, state attorneys general or sector regulators.
Question 4: What does 'data minimization' mean in a privacy compliance context?
- Compressing data files to reduce storage costs
- Collecting only the personal data necessary for the specified purpose (Correct answer)
- Deleting all data older than one year
- Limiting data access to senior management only
Correct answer: Collecting only the personal data necessary for the specified purpose
Data minimization is a privacy principle requiring organizations to collect and retain only the personal data that is necessary and proportionate to the purpose for which it was collected.
Question 5: HIPAA's Security Rule applies specifically to:
- All personal data held by any US employer
- Electronic protected health information (ePHI) held by covered entities and their business associates (Correct answer)
- Medical devices sold by manufacturers
- Insurance claims submitted on paper only
Correct answer: Electronic protected health information (ePHI) held by covered entities and their business associates
The HIPAA Security Rule establishes national standards for protecting ePHI that is created, received, used, or maintained by covered entities and business associates.
Question 6: A 'Privacy Impact Assessment (PIA)' is MOST useful for:
- Calculating the cost of data breach litigation
- Identifying and addressing privacy risks before launching a new program or technology (Correct answer)
- Auditing completed projects for past privacy violations
- Training employees on privacy policies
Correct answer: Identifying and addressing privacy risks before launching a new program or technology
A PIA evaluates how a new system, program, or process will collect and use personal data, enabling organizations to address privacy risks proactively at the design stage.
RCC RCC Data Privacy and Information Security Compliance 1
Under the California Consumer Privacy Act (CCPA), consumers have the right to: