Exam CIPP-US topic 1 question 208 discussion

While I understand what twiny is saying, I think the fact that we are focused on "state" data security and privacy laws, I am inclined to choose C. I think A is more likely the subject of federal laws as noted below. However, The Drivers Privacy Protection Act (DPPA) requires all States to protect the privacy of personal information contained in an individual's motor vehicle record. My assumption is that is accomplished via individual state laws specific to the issue.

The correct answer is: A. Account holders’ social security numbers, maintained by a bank. Selecting choice A as the correct answer was very difficult for me because it talks about banks maintaining account holders’ social security numbers. Banks are covered under the Gramm-Leach-Bliley Act (GLBA), which is a federal regulation, while the question specifically asks about state data security and privacy laws. On the other hand, the question does not explicitly exclude data covered under both federal and state laws, nor does it specify that the entity (e.g., a bank) must be regulated only by state laws. Therefore, since SSNs are regulated by both federal and state laws in overlapping ways (even when maintained by banks), they are the most comprehensively regulated data element in the options provided, making choice A the best answer to the question asked. I'll be happy to see the opinions of other users here.