Certified Information Privacy Professional – United States (CIPP/US) — Question 113

Sarah lives in San Francisco, California. Based on a dramatic increase in unsolicited commercial emails, Sarah believes that a major social media platform with over 50 million users has collected a lot of personal information about her. The company that runs the platform is based in New York and France.
Why is Sarah entitled to ask the social media platform to delete the personal information they have collected about her?

Answer options

• A. Any company with a presence in Europe must comply with the General Data Protection Regulation globally, including in response to data subject deletion requests.
• B. Under Section 5 of the FTC Act, the Federal Trade Commission has held that refusing to delete an individual’s personal information upon request constitutes an unfair practice.
• C. The California Consumer Privacy Act entitles Sarah to request deletion of her personal information.
• D. The New York “Stop Hacks and Improve Electronic Data Security” (SHIELD) Act requires that businesses under New York’s jurisdiction must delete customers’ personal information upon request.

Correct answer: C

Explanation

The correct answer is C because the California Consumer Privacy Act specifically grants California residents, like Sarah, the right to request the deletion of their personal information. While options A, B, and D discuss relevant laws and regulations, they do not apply directly to Sarah's situation in California regarding her personal data held by the social media platform.