Ch. 7 State Privacy Law Quiz

Question 1

Which are exceptions to state breach notification laws? Select all that apply.

A. Entities subject to other, more stringent data breach notification laws
B. Entities that already follow breach notification procedures that are compatible with state law
C. Entities enrolled in self-certification programs that meet industry security standards

Answer 1

A. Entities subject to other, more stringent data breach notification laws

B. Entities that already follow breach notification procedures that are compatible with state law

Question 2

Which state data security law is generally considered the most prescriptive in the nation?

A. California AB 1950 (2004)
B. Massachusetts 201 CMR 17
C. Washington state security law, HB 1149

Answer 2

B. Massachusetts 201 CMR 17

Question 3

Which of the following preempts state law in most areas

A. The Fair and Accurate Credit Transactions Act (FACTA)
B. The Fair Credit Reporting Act (FCRA)
C. The Gramm-Leah Bliley Act (GLBA)
D. The Financial Turmoil Reconciliation Assurance Act (FTRAA)

Answer 3

A. The Fair and Accurate Credit Transactions Act (FACTA)

Question 4

What is the CalOPPA?

Answer 4

The California Online Privacy Protection Act.

Question 5

The California law SB-1386 requires businesses that hold computerized personal information to inform consumers if:

A. they go out of business
B. there is a security breach
C. the business has a sale
D. the personal information has not changed

Answer 5

B. there is a security breach

Question 6

As of December 2021, how many states in the U.S. have security breach notification laws?

A. 20
B. 30
C. 45
D. 50

Answer 6

D. 50

All 50 U.S. states have laws that require business entities to notify individuals when their personally identifiable information (PII) has become compromised due to a data breach.

Question 7

The California SB 1386 covers:

A. health insurance information from California residents.
B. personal information of employees in the state of California.
C. computerized personal information of California residents.
D. SSN information from organizations in the state of California.

Answer 7

C. computerized personal information of California residents.

Question 8

The California SB 1386 requires that:

A. medical information is not collected or stored by state employees in California.
B. computerized personal information is appropriately protected.
C. inappropriate access of encrypted or unencrypted personal information must be promptly reported to the affected individuals.
D. inappropriate access of unencrypted personal information must be promptly reported to the affected individuals.

Answer 8

D. inappropriate access of unencrypted personal information must be promptly reported to the affected individuals.

Question 9

Which state data security law is generally considered the most prescriptive in the nation?

A. California AB 1950 (2004)
B. Massachusetts 201 CMR 17
C. Washington state security law, HB 1149
D. All have the same requirements.

Answer 9

B. Massachusetts 201 CMR 17

Question 10

True or false?

Most U.S. states have laws limiting the use of Social Security numbers.

Answer 10

True

Question 11

True or false?

For data breach notification, state laws require email notice to be the default mode of communication.

Answer 11

False

Question 12

True or False?

At the state level, the FTC brings a variety of privacy-related enforcement actions pursuant to state laws prohibiting unfair and deceptive practices.

Answer 12

False. State attorneys general enforce state privacy-related laws.

Question 13

Typically, US state security laws apply to all of the following EXCEPT:

A. financial account number
B. name and SSN
C. driver’s license number
D. anonymized information

Answer 13

D. anonymized information

Question 14

According to state security laws, which of the following states specifically requires that sensitive personal information is encrypted?

A. New York
B. California
C. Nevada
D. Maine

Answer 14

C. Nevada

Question 15

According to state security laws, which of the following states requires that access to sensitive personal information be limited to paper records?

A. New York
B. California
C. Nevada
D. Maine

Answer 15

A. New York

Question 16

Many state security laws have special rules for social security numbers, which include all of the following EXCEPT:

A. SSNs cannot be printed on ID cards
B. SSNs can be printed on paychecks, but only if necessary
C. SSNs cannot be publicly displayed
D. Individuals cannot be required to provide SSNs

Answer 16

B. SSNs can be printed on paychecks, but only if necessary

Question 17

In which state must organizations notify affected individuals in the case of a privacy breach, despite the fact that there is no risk of harm?

A. Arizona
B. Texas
C. California
D. New Jersey

Answer 17

C. California

Question 18

Unlike other state security laws, the state of Oregon requires that which of the following pieces of information is included in a breach notification letter?

A. the date of the breach
B. contact information for state regulators
C. contact information for consumer reporting agencies
D. a description of the incident

Answer 18

A. the date of the breach

Question 19

True or false?

Most U.S. states have laws limiting the use of Social Security numbers.

Answer 19

True

Question 20

True or false?

When federal laws do not provide a consumer protection that a state believes is necessary, the state may enact a law to provide the protection for its citizens.

Answer 20

True

Question 21

In the event of a data breach, Connecticut’s breach notification law defines personal information as the first name (or initial) and last name in combination with one or more what? Select all that apply.

A. Social Security number 
B. Driver’s license number 
C. Mailing address 
D. Phone number 
E. Bank account or card number in combination with a security or access code

Answer 21

A. Social Security number
B. Driver’s license number
E. Bank account or card number in combination with a security or access code

Question 22

The California Data Breach Notification Law requires:

A. California companies to pass an annual inspection of their information security systems
B. California companies to submit a press release to the public when there is a security breach to their systems
C. companies to notify California residents when their personal information may have been accessed by an unauthorized third party through a security breach and may be at risk for identity theft.
D. companies to have 24/7 security personnel to respond immediately to security breaches and notify the proper authorities

Answer 22

C. companies to notify California residents when their personal information may have been accessed by an unauthorized third party through a security breach and may be at risk for identity theft.

Question 23

The California data breach notification law (SB 1386):

A. Defines personal information as the person’s name only
B. Does not provide for monetary damages in the event of a breach
C. Is enforced by the California Attorney General and allows for a private right of action
D. Requires encryption of all personal information

Answer 23

C. Is enforced by the California Attorney General and allows for a private right of action

Practice Test #2

Question 24

Which of the following are required for an entity to be considered a “business” under the California Consumer Privacy Act? Select all that apply.

A. An entity that makes $10 million in annual revenue
B. An entity that holds the personal information of 50,000 people, households or devices
C. An entity that makes at least half of its revenue from the sale of personal information
D. All of the above.

Answer 24

B. An entity that holds the personal information of 50,000 people, households or devices

C. An entity that makes at least half of its revenue from the sale of personal information

“Has annual gross revenues exceeding $25 million.

“Alone or in combination, annually buys, receives for the business’s commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households, or devices.”

“Receives 50 percent or more of annual revenue results from sales of consumers’ personal information.

Question 25

Which are exceptions to state breach notification laws? Select all that apply.

A. Entities subject to other, more stringent data breach notification laws
B. Entities that already follow breach notification procedures that are compatible with state law
C. Entities enrolled in self-certification programs that meet industry security standards
D. None of the above.

Answer 25

A. Entities subject to other, more stringent data breach notification laws

B. Entities that already follow breach notification procedures that are compatible with state law

Question 26

Which state data security law is generally considered the most prescriptive in the nation?

A. California AB 1950 (2004)
B. Massachusetts 201 CMR 17
C. Washington state security law, HB 1149
D. All have the same requirements.

Answer 26

B. Massachusetts 201 CMR 17

Question 27

The California Online Privacy Protection Act of 2013 (CalOPPA), amended by Assembly Bill 370, requires:

a. Privacy policies to include information on how the operator responds to ‘Do Not Track’ signals or similar mechanisms
b. Privacy policies to state whether third parties can collect PII about the site’s users
c. The operator of a website to display a privacy notice that meets certain content requirements
d. All of the above

Answer 27

d. All of the above

Question 28

Which of the following is not required to be included in a privacy notice under CalOPPA?

a. Categories of PII collected through the site, and categories of third parties with who the operator may share PII or other content
b. How the operator responds to the web browser’s Do Not Track signals or other mechanisms that provide consumers the ability to choose regarding collection of PII about an individual consumer’s online activities over time and across third party websites
c. Whether other parties may collect PII about a consumer’s online activities over time and across different websites when a consumer uses the operator’s website
d. All of the above

Answer 28

d. All of the above