Certified Information Privacy Professional – United States (CIPP/US) — Question 202

Under the California Consumer Privacy Act (as amended by the California Privacy Rights Act), a consumer may initiate a civil action against a business for?

Answer options

• A. Any personal information that is subject to unauthorized access or disclosure.
• B. A security breach of certain categories of personal information that is nonencrypted and nonredacted.
• C. Failure to implement and maintain reasonable security procedures and practices to protect the personal information held.
• D. Failure to implement and maintain security practices set out in regulations issued by the California Privacy Protection Agency (CPPA).

Correct answer: B

Explanation

The correct answer is B because the California Consumer Privacy Act allows consumers to take legal action specifically for breaches involving nonencrypted and nonredacted personal information. Options A, C, and D relate to broader security concerns but do not directly provide grounds for a civil action under the Act.