Quiz 1B — State Breach Notification and Private Damages | LawZeee — Know Your Cyber Laws Before You Break It

Question 1

Under California Civil Code § 1798.82 (effective January 1, 2026), how many calendar days does a company have to notify California residents after discovering a breach of their personal information?

A72 hoursB10 calendar daysC30 calendar daysD60 calendar days

Question 2

Apex Corp discovered a breach on March 1, 2026. They notified law enforcement, who requested a delay in consumer notification to protect an ongoing criminal investigation. When must Apex notify consumers?

AWithin 30 days of March 1 (by March 31), regardless of the law enforcement requestBWithin 30 days of March 1, unless law enforcement provides a documented request for delay — the delay lasts only as long as law enforcement requires itCLaw enforcement delay suspends the notification obligation indefinitelyDApex has 72 hours regardless of law enforcement involvement

Question 3

A breach at a California company exposes the login credentials (username + hashed password) of 12 million users. What is the maximum statutory damages exposure under California Civil Code § 1798.150?

A$1.2 millionB$120 millionC$900 millionD$9 billion

Question 4

What is the required pre-suit procedural step before a consumer can file a California Civil Code § 1798.150 lawsuit?

AFiling a complaint with the California Attorney General firstBProviding the business 30 days' written notice identifying the specific violations, allowing the business an opportunity to cureCExhausting administrative remedies with the California Privacy Protection AgencyDNo pre-suit step is required — suit can be filed immediately after a breach

Question 5

A New York bank regulated by the Department of Financial Services (DFS) experiences a ransomware attack. What is the DFS incident notification deadline under 23 NYCRR 500?

A30 days from discoveryB72 hours from determining a qualifying cybersecurity event occurredC24 hours from the first alertD10 business days from containment

Question 6

Which of the following best describes California Penal Code § 502's civil action for a willful unauthorized intrusion that was committed with malice?

AOnly injunctive relief is available — no damagesBOnly compensatory damages are availableCCompensatory damages, injunctive relief, potential attorney's fees, and punitive damages (under heightened showing) are all availableDOnly statutory damages of $100–$750 per consumer are available

Question 7

A class action plaintiff's counsel is evaluating whether to sue after a breach of 5 million California consumers' Social Security numbers. Which statutory damages regime is most directly applicable?

ACalifornia Penal Code § 502BCalifornia Civil Code § 1798.82CCalifornia Civil Code § 1798.150DNew York GBS § 899-aa

Question 8

Under New York GBS § 899-aa, when must a company notify affected New York residents after discovering a breach?

AWithin 24 hoursBAs soon as possible without unreasonable delay, but within 30 days after discoveryCWithin 60 days after discoveryDWithin a "commercially reasonable" time with no outer deadline

Question 9

When a California company notifies consumers of a breach affecting more than 500 California residents, what additional obligation does § 1798.82 impose?

APay a per-consumer fee to the California Privacy Protection AgencyBSubmit a sample copy of the notification to the California Attorney GeneralCFile a form with the Federal Trade CommissionDPublish the notification in a California newspaper of general circulation

Question 10

Which of the following breach scenarios most clearly does NOT require notification under California Civil Code § 1798.82?

ATheft of unencrypted Social Security numbers stored in a databaseBUnauthorized access to an encrypted hard drive where the encryption key was not also accessedCExfiltration of medical records with names and diagnosesDTheft of username and plaintext password combinations