{
  "question_text": "When must Rapido Facil Exchange Co. provide customers with a privacy notice?",
  "options": [
    "At the time of their first transaction and annually thereafter",
    "Only at the time of their first transaction",
    "Only when Rapido Facil Exchange Co.'s information sharing practices change",
    "Every two years and at the time of their first transaction"
  ],
  "correct_answer": "At the time of their first transaction and annually thereafter",
  "correct_response": "Correct. Customers must receive a privacy notice at their first transaction — and then every year after that. The annual notice is required regardless of whether anything has changed.",
  "incorrect_response": "Customers must receive a privacy notice at their very first transaction, and then again every year after that. A one-time notice at sign-up is not enough — the annual notice is always required.",
  "unsure_response": null,
  "question_bank": [
    {
      "question_text": "If a customer asks Rapido Facil Exchange Co. to opt out of certain information sharing, how quickly must that request be honored?",
      "options": [
        "Within 30 days",
        "Within 24 hours",
        "Within 72 hours",
        "Within 60 days"
      ],
      "correct_answer": "Within 30 days",
      "correct_response": "Correct. Opt-out requests must be honored within 30 days. Timely processing preserves customers' legal rights under federal privacy law.",
      "incorrect_response": "Opt-out requests must be honored within 30 days. Not 24 hours, not 60 days — 30 days is the federal standard. Processing too slowly can violate customers' legal rights.",
      "unsure_response": null
    },
    {
      "question_text": "A security breach affects 600 Florida residents. In addition to notifying affected individuals, what must Rapido Facil Exchange Co. do within 30 days?",
      "options": [
        "Notify the Florida Department of Legal Affairs",
        "File a SAR with federal regulators",
        "Notify only the federal government, not the Florida Department of Legal Affairs",
        "Engage legal counsel and await their instructions before contacting anyone"
      ],
      "correct_answer": "Notify the Florida Department of Legal Affairs",
      "correct_response": "Correct. When a breach affects 500 or more Florida residents, Rapido Facil Exchange Co. must notify the Florida Department of Legal Affairs within 30 days of determining a breach occurred. Written notice to affected individuals is also required within the statutory deadline.",
      "incorrect_response": "When 500 or more Florida residents are affected, Rapido Facil Exchange Co. must notify the Florida Department of Legal Affairs within 30 days of breach determination — and send written notice to affected individuals. Engaging legal counsel is required within 24 hours of discovery, but that alone does not satisfy the notification obligation.",
      "unsure_response": null
    }
  ],
  "enrichment_content": "<p><strong>Privacy notice rules are straightforward:</strong></p><ul><li>Give every customer a privacy notice at their <strong>first transaction</strong>.</li><li>Give every customer a privacy notice <strong>once a year</strong> after that.</li><li>The notice must explain what information you collect, who you might share it with, and the customer's <strong>right to opt out</strong>.</li><li>If a customer asks to opt out, you must honor that request within <strong>30 days</strong>.</li></ul>"
}