Certified Information Privacy Professional – United States (CIPP/US) — Question 125

A California resident has created an account on your company's online food delivery platform and placed several orders in the past month. Later she submits a data subject request to access her personal information under the California Privacy Rights Act.

Assuming that the CPRA is in force, which of the following data elements would your company NOT have to provide to the requester once her identity has been verified?

Answer options

• A. Inferences made about the individual for the company's internal purposes.
• B. The loyalty account number assigned through the individual's use of the services.
• C. The time stamp for the creation of the individual's account in the platform's database.
• D. The email address submitted by the individual as part of the account registration process.

Correct answer: A

Explanation

The correct answer is A because the CPRA does not require companies to disclose inferences made for internal purposes. Options B, C, and D are all types of personal information that must be shared once the individual's identity is verified under the CPRA.