nerdexam
IAPP

CIPP-US · Question #80

A California resident has created an account on your company's online food delivery platform and placed several orders in the past month Later she submits a data subject request to access her personal

The correct answer is A. Inferences made about the individual for the company s internal purposes. Under the California Privacy Rights Act (CPRA), which amends the California Consumer Privacy Act (CCPA), California residents have the right to request access to their personal information collected by a business. However, the CPRA provides an exception for inferences made about

State Privacy Laws

Question

A California resident has created an account on your company's online food delivery platform and placed several orders in the past month Later she submits a data subject request to access her personal information under the California Privacy Rights Act. Based on the CPRA. which of the following data elements would your company NOT have to provide to the requestor once her identity has been verified?

Options

  • AInferences made about the individual for the company s internal purposes
  • BThe loyalty account number assigned through the individuals use of the services
  • CThe time stamp for the creation of the individual's account in the platform's database.
  • DThe email address submitted by the individual as part of the account registration process.

How the community answered

(25 responses)
  • A
    72% (18)
  • B
    8% (2)
  • C
    4% (1)
  • D
    16% (4)

Explanation

Under the California Privacy Rights Act (CPRA), which amends the California Consumer Privacy Act (CCPA), California residents have the right to request access to their personal information collected by a business. However, the CPRA provides an exception for inferences made about an individual for internal purposes, meaning businesses are not obligated to disclose inferences generated solely for internal use. Key Points Under the CPRA: Access to Personal Information: Businesses must provide consumers with access to personal information they have collected, which includes data submitted by the consumer and other information directly associated with the Exception for Inferences: Inferences made about a consumer, particularly when used for internal purposes (e.g., improving services, analytics, or predicting preferences), are not explicitly required to be disclosed under the CPRA unless they are part of the consumer's profile or used for decision-making purposes that affect the consumer. Examples of Data to Be Provided: Information provided by the consumer (e.g., email address, account information). Automatically collected information (e.g., timestamps, purchase history). Identifiers (e.g., loyalty account numbers).

Topics

#CPRA#data subject access rights#inferences#exceptions

Community Discussion

No community discussion yet for this question.

Full CIPP-US Practice