Applicability thresholds and exemptions in state privacy laws

5 minutes 5 Questions

Revenue and consumer-count thresholds, entity-level versus data-level exemptions for HIPAA and GLBA data, and the nonprofit and employee-data carve-outs that differ by state.

Test mode:
Start practice test

CIPP/US - Applicability thresholds and exemptions in state privacy laws Example Questions

Test your knowledge of Applicability thresholds and exemptions in state privacy laws

Question 1

A nonprofit organization processes personal data of many state residents and wonders whether a comprehensive state consumer privacy statute reaches it. Its privacy lead surveys several enacted statutes and finds that treatment of nonprofits varies. Which statement best captures how these laws handle nonprofit entities across the states that have adopted them?

Correct Answer: Several statutes carve nonprofits out entirely, while a handful extend coverage to them once processing thresholds are met

The correct answer accurately reflects the patchwork reality: most comprehensive state privacy laws like California, Virginia, and Colorado exempt nonprofits entirely, while a few such as Colorado and Oregon extend coverage once processing thresholds are met.

The claim that every statute covers nonprofits under volume thresholds is wrong because many states exempt them outright. The claim that all statutes categorically exclude nonprofits is wrong because some states do reach them. Coverage is not conditioned on a federal sectoral law like GLBA governing their data; that reasoning conflates entity exemptions with data-level exemptions.

Key concept: variation in entity-level nonprofit exemptions across state comprehensive privacy statutes.

Question 2

A regional employer collects personal information from its workforce and job applicants. It also runs a small consumer-facing website that gathers data from a few thousand shoppers annually. A manager asks whether the company must honor the consumer rights created by a comprehensive state privacy statute for the employee and applicant records. What is the best response?

Correct Answer: Most comprehensive state statutes carve out data processed in an employment or applicant context, so those workforce records fall outside the consumer rights framework.

The correct answer is right because most comprehensive state privacy laws, such as the CCPA/CPRA and others, exempt personal information collected in the employment and job applicant context from the consumer rights framework, treating those individuals separately from consumers.

The option claiming workforce records automatically become consumer data misstates the statutory definitions. The financial institution answer confuses this with sector-specific laws like GLBA. The volume threshold answer wrongly assumes crossing a numeric trigger converts employment records into consumer records; thresholds affect applicability to the business, not the category of data.

Key concept: the employee and applicant exemption under comprehensive state privacy statutes.

Question 3

An organization is comparing its obligations under two comprehensive state consumer privacy statutes. It meets the applicability threshold in State A because it derives a large share of revenue from selling personal data, yet it falls below every threshold in State B despite processing similar volumes there. What best explains why the same processing activity yields opposite applicability outcomes across the two states?

Correct Answer: Threshold criteria and their triggering counts vary by state, so revenue-based and volume-based tests produce different applicability results

The correct answer is right because state comprehensive privacy laws set their own applicability thresholds, using combinations of revenue, data-sale percentage, and consumer-volume counts that differ across states, so identical processing can trigger coverage in one state but not another.

The federal baseline answer is wrong because there is no comprehensive federal privacy statute providing a uniform baseline. The residency-only answer is wrong because applicability depends on thresholds, not solely on where consumers reside. The data-broker carve-out answer is wrong because it invents a specific exemption not driving this outcome.

Key concept: state-specific applicability thresholds for comprehensive consumer privacy laws.

More Applicability thresholds and exemptions in state privacy laws questions
27 questions (total)
Start 27 question test

Other State Privacy Laws concepts

California CCPA as amended by the CPRACalifornia Consumer Privacy Act (CCPA) and CPRAConsumer rights common to the state comprehensive lawsFederal vs. State Authority and PreemptionKey Differences Among State Breach Notification LawsNYDFS Part 500 cybersecurity regulationOther Comprehensive State Privacy LawsRecent State Privacy Legislative DevelopmentsSensitive data and consent under state lawsState attorney general enforcement and cure periodsState biometric privacy lawsState consumer health data lawsState Data Breach Notification Law ElementsState Security Procedures and Cookie RegulationsState SSN and Data Destruction LawsUniversal opt-out mechanismsVirginia Consumer Data Protection Act (VCDPA)
All State Privacy Laws questions · CIPP/US practice test