Certified Information Privacy Professional – United States (CIPP/US) — Question 123

ABC Corp. is a consumer-facing business that uses a number of vendors to help operate its business, such as payment processors, cloud service providers, and an e-commerce platform.

If ABC Corp. were subject to the California Consumer Privacy Act (CCPA), what would it have to do in order to avoid having its transfer of personal information to vendors be considered a "sale" of personal information?

Answer options

• A. Register its transfer of personal information with the California Attorney General's office.
• B. Ensure that it does not receive any monetary consideration from the vendors for the personal information.
• C. Enter into a contract with the vendors containing restrictions on what they can do with the personal information.
• D. State in its privacy policy that it will only transfer the personal information to vendors who provide the business with certain services.

Correct answer: C

Explanation

The correct answer is C because entering into a contract with vendors that specifies restrictions on their use of personal information helps define the relationship and limits how that information can be used, thus avoiding it being considered a sale. Options A and B are not requirements under the CCPA for preventing the classification as a sale, while option D does not impose necessary limitations on the use of the information.