Ch. 12 - Workplace Privacy Quiz Flashcards
Which of the following is not a key attribute of security?
A. Confidentiality
B. Integrity
C. Delivery
D. Availability
C. Delivery
Which type of security controls can be considered in developing a security strategy?
A. Physical, administrative, technical
B. Practice, reactive, distortive
C. Detective, cumulative, reactive
D. Physical, cosmetic, digital
A. Physical, administrative, technical. In the context of security. The controls are most often physical, administrative, technical
What is the best fitting description of a data breach?
A break into security measures resulting in the unauthorized access of data for a breach, just remember that something must have gone wrong either malicious or incidental, where something didn’t work the way it should have worked (w/ exception depending on the definitions in the specific legislation.
When a consent decree is published, what has happened?
The FTC and the other party entered in an agreement to stop a certain conduct, and the information is published for other organizations to see.
How can the Federal Trade Commission be best described?
A part of the executive branch w/ rulemaking powers
Selfie Shenanigans is planning to implement its newest feature in US (only). It will analyze all uploaded photos for visible signs of health issues. The data is sold to the user’s health insurer which law would least possibly be broken?
A. HIPAA
B. Children’s Online Privacy Protection Act
C. GDPR
D. HITECH
C. GDPR only applies to Europe this was in the US only
Selfie Shenanigans. You find out the website has a privacy notice that is shown before users sign up. What needs to happen?
A check whether the new practice is allowed for, according to the privacy notice, needs to be performed
For which law does the FTC have specific authority?
A. GDPR
B. Children’s Online Privacy Protection Act
C. The APEC Privacy Framework
D. Fair Information Practices
B. Children’s Online Privacy Protection Act. Only US law, otherwise Fair Information Practices are mentioned.
What safeguard is often put in place by researchers when using medical data for research?
The data is de-identified. De-identification lowers the risk of recognition.
To what kind of institutions does the Family Educational Rights and Privacy Act apply?
Educational institutions that receive federal funding
Which type of information is still allowed to be disclosed under the Family Educational Right & Privacy Act?
A. Grade point average
B. Directory information
C. Home address students
D. Health insurance coverage
B. Directory information - is allowed to be disclosed. Whether the other three fall under FERPA can be debatable perhaps to some extent
Due to the 2007 revisions to the Federal Rules of Civil Procedures what is now required?
Redacting sensitive personal information
Which of the following is not required of a subpoena according to the Federal Rule of Civil Procedure 45?
A. State the court from which it is issued
B. State the title of the action and its civil action number
C. Take photographic evidence of the receipt of the subpoena
D. Mention a person’s right to challenge or modify the subpoena
C. Take photographic evidence of the subpoena, A, B, and D are explicitly required
How can courts prohibit the disclosure of personal information used or generated in litigation?
A. The court can issue a protective order
B. The court can issue a restrictive order
C. The court can issue a reactive order
D. The court can issue a national security letter
A. The court can issue a protective order
In 2016 the FBI was quarreling with Apple. What was the quarrel about?
A. new firmware slowing down phones
B. helping gain access to the data on a seized phone
C. the tablets in the Federal Bureau of Investigation’s office could not fit the micro-SD required for the investigation
D. a cloud security breach exposing pictures of celebrities
B. Helping gain access to the data on a seized phone
Which of the following is most accurate regarding workplace privacy?
A. Workplace privacy is the same in every state
B. US privacy protection at the workplace is the strictest in the world
C. Workers have a high level of influence in workplace practices
D. There is no law that covers privacy specifically
D. There is no law that covers privacy specifically
Which of the following is not a source of protection for employees?
A. State labor laws
B. Contract and tort law
C. Overarching employment privacy law
D. Certain federal laws
C. Overarching employment privacy laws
What is the most accurate comparison between US and EU workplace privacy?
A. the US inspired the EU legislation
B. the EU has no law that is applicable to the workplace
C. the US had cubicles, whereas in the EU cubicles are forbidden because of privacy concerns
D. EU employees data falls under the scope of the General Data Protection Regulation and offers more protection
D. EU employees data falls under the scope of the General Data Protection Regulation and offers more protection
What can be said about the constitution’s Fourth Amendment?
A. it provides protection from employers
B. it provides protection from government employers
C. it doesn’t concern privacy
D. it only protects against the king of England
B. it provides protection from government employers
In the US, it is employment at will. What is the consequence of this?
A. all legislation is rendered invalid
B. you can buy privacy
C. many aspects, covered by laws in other continents, are at the discretion of the employer
D. employees have no rights
C. many aspects, covered by laws in other continents, are at the discretion of the employer
Which of the following is not tort that can be relied on as an employee in a privacy case?
A. intrusion upon seclusion
B. publicity given to private life
C. defamation
D. intellectual property
D. intellectual property
Of the following laws, which does not have employment privacy implications?
A. The Children’s Online Privacy Protection Act
B. The Employee Retirement Income Security Act
C. HIPAA
D. The Fair Labor Standards Act
A. The Children’s Online Privacy Protection Act
At which state of employment do employers need to take into account workplace privacy considerations
A. before employment
B. before, during, and after employment
C. during employment
D. after employment
B. before, during, and after employment
What is true about Bring Your Own Device policies?
A. only company-issued equipment is allowed to be used
B. it brings along security risks and requires reconsideration of the level of monitoring
C. employees surrender their data when a Bring Your Own Device policy is in place
D. Bring Your Own Device practices are illegal
B. it brings along security risks and requires reconsideration of the level of monitoring
Which of the following is a consequence of the Employee Polygraph Protection Act?
A. only grade A and B type polygraphs are allowed to be used
B. an employer cannot use a polygraph test to screen an applicant
C. a statement of sincerity is required to substitute a polygraph
D. employers cannot screen applicants
B. an employer cannot use a polygraph test to screen an applicant
Which of the following agencies is not responsible for privacy enforcement?
A. The FTC
B. Department of Education
C. FCC
D.Certain agencies of the executive branch
B. Department of Education
What is true of the FTC?
A. The FTC is an independent agency
B. The FTC falls under direct control of the president
C. The FTC focuses solely on privacy
D. The FTC focuses solely on security
A. The FTC is an independent agency
What was the issue in the Designerware, LLC
case?
A. the leaking of a large amount of credit card numbers
B. key loggers, unexpected screenshots and photographs
C. a break-in on one of the servers that stored social security numbers
D. unauthorized disclosure of collected sensitive data
B. key loggers, unexpected screenshots and photographs
When is a data breach to be reported?
A. above 200 persons
B. above 100 persons
C. if minors are involved
D. depends on the state and breach size
D. depends on the state and breach size
Is ransomware a data breach?
A. always
B. never
C. depends on whether unauthorized access has been established
D. not if the information was backed up
C. depends on whether unauthorized access has been established
Ransomware - (a type of malware)
(1) locks a user’s operating system, restricting the user’s access to their data &/ or device, or
(2) encrypts the data so that the user is prevented from accessing his or her files
Certain national laws preempt state law. Out of the following choices, how can preempting best be described?
A. privacy notice, under many circumstances, can be overruled by state law
B. laws of an inferior government can be superseded by those of a superior government
C. if a state has no law, it is preempted by national law
D. federal judges can preempt the president and a large part of the executive branch
B. laws of an inferior government can be superseded by those of a superior government
Although there are many actions an individual can take to battle injustice, which of the following most accurately describes the private right of action?
A. to carry a concealed weapon and use it protect your privacy when someone attempts to enter your domicile
B. to start a lawsuit when a law is violated
C. to enforce the binding rules of a privacy notice
D. to forbid organizations from processing the data of minors that you are the legal guardian of
B. to start a lawsuit when a law is violated
If an agency has authority, there are two types of authority that agency can have. Which type of authority does the FTC have?
A. general authority
B. specific authority
C. general authority as well as specific authority
D. operational authority
C. general authority as well as specific authority
Many references to privacy can be found all throughout recorded history. When looking at laws regarding Personal Information, which class of privacy does law concerning Personal Information pertain to?
A. bodily privacy
B. territorial privacy
C. communications privacy
D. information privacy
D. information privacy
Which of the following is not (yet) part of the Fair Information Practices?
A. notice
B. choice and consent
C. disclosure
D. legal basis
D. legal basis
All over the world, different models of privacy protection are adopted. Which of the following is true regarding models of privacy protection?
A. in the US there is a sectoral model, and in the EU there is a comprehensive model
B. the US only uses the co-regulatory model
C. Europe has a strong focus on the self-regulatory model
D. the laws in the US fall under the comprehensive model
A. in the US there is a sectoral model, and in the EU there is a comprehensive model
Which of the following best describes the relationship between case law and common law?
A. common law needs case law to exist
B. common law is based on principles
C. case law is solely the judge’s opinion
D. case law is fluid and allows for presidential intervention
A. common law needs case law to exist
When can an organization most likely most likely be in trouble for violating contract law?
A. when someone provided their data based on the practices mentioned in the privacy notice
B. when a data subject disagrees with a privacy notice
C. when a privacy notice is not in the local language
D. when a privacy notice is not on the organization’s website
A. when someone provided their data based on the practices mentioned in the privacy notice
How can Personal Information best be described?
A. any information relating to a natural person
B. this depends on the field and even state law
C. directory information
D. information of value
B. this depends on the field and even state law
Which comprehensive privacy laws there in the US?
A. the Children’s Online Privacy Protection Act
B. HIPAA
C. None, there are no comprehensive privacy laws in the US
D. GDPR
C. None, there are no comprehensive privacy laws in the US
Of the following, which are three different tort categories?
A. negligence, notice breach, intrusion
B. intrusion upon seclusion, strict liability
C. intentional, negligent, strict liability
D. privacy notice breach, wrongful intrusion, defamation
C. intentional, negligent, strict liability
Which of the following is most restrictive for employers in the US in relation to privacy?
A. HIPAA
B. Children’s Online Privacy Protection Act
C. Fourth Amendment
D. Fair and Accurate Credit Transactions
C. Fourth Amendment
What is the most likely purpose for which an organization creates a data inventory?
A. showing the public which data is stored
B. creating an overview of data, helpful for creating a compliance and security approach
C. complying with a US legal requirement
D. identifying storage size requirements
B. creating an overview of data, helpful for creating a compliance and security approach
Which of the following statements is not true regarding data classification?
A. organizations are free to classify data elements a certain way to place it inside or outside of the scope of certain laws
B. data classification can help identify applicable laws
C. to assist in creating a security strategy
D. help breach response
A. organizations are free to classify data elements a certain way to place it inside or outside of the scope of certain laws
What is not the result of an organization starting a privacy program?
A. awareness amongst employees
B. reduced risk of compliance issues
C. an increase in breach detection rate and breach response time
D. full future proof of compliance with privacy legislation
D. full future proof of compliance with privacy legislation
What is the name of the guidelines developed by the Asia-Pacific Economic Cooperation?
A. the OECD guidelines
B. The IT Act
C. The Fair Information Practices
D. The APEC Privacy framework
D. The APEC Privacy framework
True or false? The word privacy is not mentioned in the U.S. Constitution
True
Which of the following sources of law affect privacy for private-sector employees? Select all that apply.
A. Federal constitutional law B. Contract law
C. Torts
D. Statutes
B. Contract law
C. Torts
D. Statutes
True or false?
Federal law mandates substance use testing for certain positions.
True
Read the scenario and determine if it qualifies as an exception or non-exception to FERPA’s non-consensual disclosure rules:
- School Instruction Improvement Company, Inc. accesses school records to verify the demographics of the student body.
Disclosure allowed: Disclosing information to organizations on the behalf of schools for test development, student aid programs or instruction improvement is acceptable.
What are the advantages and disadvantages of BYOD programs in the workplace?
Advantages:
• Same home/work technology
• More flexibility • Efficiency and productivity
• Employer increased accessibility to employee
- Disadvantages:
- Lack of employer control
- Exposure of organization to security vulnerabilities and threats
In addition to the Americans with Disabilities Act, which federal laws* prohibit discrimination in the workplace?
Title VII of the Civil Rights Act of 1964 bars discrimination in employment due to race, color, religion, sex and national origin
• The Equal Pay Act of 1963 bars wage disparity based on sex
• The Age Discrimination Act bars discrimination against individuals over 40
• The Discrimination Act bars discrimination due to pregnancy, childbirth and related medical conditions
• The Americans with Disabilities Act of 1990 bars discrimination against qualified individuals with disabilities
• The Genetic Information Nondiscrimination Act of 2008 bars discrimination based on individuals’ genetic information
• The Bankruptcy Act provision 11 U.S.C. § 525(b) prohibits employment discrimination against persons who have filed for bankruptcy
• Some ambiguity on whether the statute applies to discrimination prior to the extension of an offer of employment; courts have read the statute both ways
True or false?
Health insurance providers may, under some circumstances, implement higher premiums based on genetic information.
False
What is COIT?
Consumerization of information technology (COIT): Use of personal computing devices in the workplace and online services (webmail, cloud storage, social media)
Which act was passed as part of the ECPA to address interception of electronic communications in facilities where electronic communication service is provided?
A. Privacy Protection Act (PPA)
B. Stored Communications Act (SCA)
C. Communications Assistance to Law Enforcement Act (CALEA)
D. Electronic Communications Privacy Act (ECPA)
B. Stored Communications Act (SCA)
Which act requires giving a privacy notice to subscribers at the time of the initial agreement (and annually thereafter) including the nature of personal information collected, how it is used, and retention period, as well as how to access and correct information?
A. Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM)
B. Telecommunications Act
C. Cable Communications Policy Act
D. Video Privacy Protection Act (VPPA)
C. Cable Communications Policy Act
Which of the following terms specifically means removing or blocking information from court documents?
A. Protective order
B. Protecting publicly available information (PPAI)
C. Electronic discovery
D. Redaction
D. Redaction
Which of the following are required for an entity to be considered a “business” under the California Consumer Privacy Act? Select all that apply.
A. An entity that makes $10 million in annual revenue
B. An entity that holds the personal information of 50,000 people, households or devices
C. An entity that makes at least half of its revenue from the sale of personal information
B. An entity that holds the personal information of 50,000 people, households or devices
C. An entity that makes at least half of its revenue from the sale of personal information
Which are exceptions to state breach notification laws? Select all that apply.
A. Entities subject to other, more stringent data breach notification laws
B. Entities that already follow breach notification procedures that are compatible with state law
C. Entities enrolled in self-certification programs that meet industry security standards
A. Entities subject to other, more stringent data breach notification laws
B. Entities that already follow breach notification procedures that are compatible with state law
True or false?
Technology companies that provide free teaching materials are subject to the laws and regulations of FERPA, PPRA and NCLBA.
True
Is there an overarching employment privacy law in the U.S.?
EXAMPLE ANSWER: There is no overarching law for employment privacy.
- Some constitutional, federal, state, tort and statutory laws impact privacy
- Contracts between employer and employee may impact privacy agreements
- There is considerable local variation and complexity on employment privacy issues
- Many U.S. labor laws mandate employee data collection and management practices, such as conducting background checks and ensuring and documenting a safe workplace environment
- Organizations also have incentives to gather information about employees and monitor the workplace to reduce the risk of being sued for negligent hiring or supervision
Read the scenario and determine if it qualifies as an exception or non-exception to FERPA’s non-consensual disclosure rules:
- Anystate University is putting together a financial aid proposal for a student who applied to the school and reviews their records to determine if the student is eligible for an academic scholarship.
ANSWER: Disclosure allowed: As it’s in connection with financial aid for which the student has applied.
Which state data security law is generally considered the most prescriptive in the nation?
A. California AB 1950 (2004)
B. Massachusetts 201 CMR 17
C. Washington state security law, HB 1149
B. Massachusetts 201 CMR 17
Under the Fair Credit Reporting Act (FCRA), which are employer requirements for obtaining a consumer report on an applicant? Select all that apply.
A. Have a permissible purpose
B. Provide notification of the intention to run a consumer report
C. Allow the applicant to receive a copy of the report
D. Obtain written authorization from the applicant
E. Use a qualified credit reporting agency
F. Provide notice to the credit reporting agency outlining the intended purpose of the report
G. Provide the applicant with notice and a copy of the report for dispute prior to adverse action
A. Have a permissible purpose
B. Provide notification of the intention to run a consumer report
C. Allow the applicant to receive a copy of the report
D. Obtain written authorization from the applicant
E. Use a qualified credit reporting agency
G. Provide the applicant with notice and a copy of the report for dispute prior to adverse action
What are the four steps involved in the development of a privacy program?
A. Discover, build, communicate, evolve
B. Research, design, build, audit
C. Brainstorm, propose, implement, follow-through
D. Test, learn, revise, monitor
A. Discover, build, communicate, evolve
Which authorities oversee privacy-related issues in the U.S.? Select all that apply.
A. The Federal Trade Commission (FTC)
B. State attorneys general
C. The national data protection authority
D. Federal financial regulators
A. The Federal Trade Commission (FTC)
B. State attorneys general
D. Federal financial regulator
Under what circumstances do limitations and exceptions to the HIPAA Privacy Rule apply?
De-identification: Information does not identify an individual via:
1. Removing data elements listed in the rule (name, address)
- An expert certifying that the risk of re-identifying is small
- Research: Can occur with the consent of the individual or without consent if an authorized entity approves it
- Other: Public health activities, such as reporting abuse or neglect, judicial and administrative proceedings, specialized government functions
- Entity must release PHI to the individual to whom it pertains or their rep. and to the secretary of HHS
Which is a provision of the Cybersecurity Information Sharing Act (CISA)? Select all that apply.
A. Companies must remove personal information before sharing
B. Companies are protected from liability for monitoring activities
C. Companies that process the personal information of 100,000 individuals or more are required to participate
D. Sharing information with the federal government does not waive privileges
E. Shared information is exempt from federal and state Freedom of Information laws
A. Companies must remove personal information before sharing
B. Companies are protected from liability for monitoring activities
D. Sharing information with the federal government does not waive privileges
E. Shared information is exempt from federal and state Freedom of Information laws
Rules that govern the collection and handling of personal information regarding internet activity can be categorized as what type of privacy?
Information privacy
True or false?
Most U.S. states have laws limiting the use of Social Security numbers.
True
True or false?
When federal laws do not provide a consumer protection that a state believes is necessary, the state may enact a law to provide the protection for its citizens.
True
Which of the following federal laws ensures that employee benefits programs are created fairly and administered properly?
A. The Health Insurance Portability and Accountability Act (HIPAA)
B. The Consolidated Omnibus Budget Reconciliation Act (COBRA)
C. The Employee Retirement Income Security Act (ERISA)
D. The Family and Medical Leave Act (FMLA)
C. The Employee Retirement Income Security Act (ERISA)
What are the DPO’s responsibilities?
To monitor compliance with the GDPR • Advise controller and processors • Manage risk • Cooperate with supervisory authorities • Communicate with data subjects and supervisory authorities • Exercise professional secrecy
examples of business activities that would cause a U.S. organization to fall under the scope of the GDPR
U.S. company offers a consumer cloud service in the EU
- U.S. company expresses its intention to deal with EU users (e.g., offering services via a European domain, local currency payment, shipment to the EU, local telephone hotline numbers)
- “U.S. company (Company A, the processor) offers data hosting services to another U.S. company (Company B, the controller). At face value, this arrangement would not be caught by the GDPR. However, if Company B (the controller) also acts on behalf of other legal entities within a group, and if personal data is transferred from these group legal entities to Company A (the processor), the arrangement may be caught by the GDPR. If one such group legal entity has an establishment in the EU (see no. 2 above), the GDPR comes into play via Article 3, Section 1.”
- The processor is a sub-processor of a principal processor based in the EU
Which of the examples of personal information may qualify as sensitive personal information? Select all that apply.
A. Social Security number
B. Bank account number
C. Driver’s license number D. Home phone number
E. Professional membership F. Medical history
G. Business email address
A. Social Security number
B. Bank account number
C. Driver’s license number
F. Medical history
Which are provisions of the Fair Credit Reporting Act (FCRA)?
Select all that apply.
A. Consumers have the ability to access and correct their information
B. Consumers may request annual updates and alerts
C. Use of consumer reports is limited to “permissible purposes”
D. Use of consumer reports is limited to three instances per six months
A. Consumers have the ability to access and correct their information
C. Use of consumer reports is limited to “permissible purposes
True or false? An organization that does not process personal data that forms part of a filing system, nor processes personal data by automated means, but does process personal data in a place where member state law applies is subject to the GDPR.
False
you must respond to requests of information in connection with criminal investigations and litigation, which laws did you have to comply when responding to such requests .
EXAMPLE ANSWERS:
• Acts involving the access of financial data
- The Electronic Communications Privacy Act (ECPA)
- The Communications Assistance to Law Enforcement Act (CALEA)
How do the CCPA and GDPR different?
- Definitions of key terms and concepts (e.g., controller)
- No definition of sensitive data under the CCPA
- No private right of action—except for data breaches—under the CCPA
What is a pen register?
A. A list of consumers who have requested to be notified if their personal information is shared with law enforcement
B. A list of law enforcement personnel who may obtain sensitive personal information without a court order
C. Records kept by financial institutions on certain financial transactions
D. A device that records the telephone numbers of all outgoing calls
D. A device that records the telephone numbers of all outgoing calls
Which legislation provides rights to parents of minors regarding sensitive information from students via surveys?
A. Family Educational Rights and Privacy Act (FERPA)
B. Protection of Pupil Rights Amendment (PPRA)
C. Children’s Online Privacy Protection Act (COPPA)
B. Protection of Pupil Rights Amendment (PPRA)
Under the Right to Financial Privacy Act (RFPA), which of the following may allow a government authority access to customer financial records?
Select all that apply.
A. Appropriate formal written request from an authorized government authority
B. Appropriate administrative subpoena or summons
C. Qualified search warrant
D. Legitimate interest of an authorized government authority
E. Customer authorization
F. Appropriate judicial subpoena
A. Appropriate formal written request from an authorized government authority
B. Appropriate administrative subpoena or summons
C. Qualified search warrant
E. Customer authorization
F. Appropriate judicial subpoena
Which are requirements under HIPAA’s Privacy Rule? Select all that apply.
A. A detailed privacy notice provided at the date of first service delivered
B. Opt-out authorization for use or disclosure of personal health information outside of HIPAA guidelines
C. Limited use and disclosure of personal health information for business associates, such as billing companies
D. Safeguards in place to protect the confidentiality and integrity of all personal health information
A. A detailed privacy notice provided at the date of first service delivered
C. Limited use and disclosure of personal health information for business associates, such as billing companies
D. Safeguards in place to protect the confidentiality and integrity of all personal health information
From the standpoint of a privacy professional, how was the collection and storage of personal information impacted by the Snowden revelations?
The case study of Edward Snowden illustrates that further reforms were necessary.Snowden’s revelations led to reforms enacted via the USA FREEDOM Act.
What actions can an organization take to proactively protect personal information in the event it is required to turn over electronic data for litigation?
- Place limits on using company email for personal use
- Discourage conducting company business on personal devices
- Implement policies and practices for when an employee leaves the organization
What is a Data Protection Officer (DPO)?
A staff member or contractor tasked with ensuring and demonstrating compliance with EU data protection law; an expert in data protection law and practices.
True or false?
Materials submitted to courts during trials are usually publicly available
True
Which act was passed during the Cold War to enable national security to track the activities of agents of the Soviet Union and its foreign allies?
A. USA PATRIOT Act
B. Foreign Intelligence Surveillance Act (FISA)
C. Cybersecurity Information Sharing Act (CISA)
D. USA FREEDOM Act
B. Foreign Intelligence Surveillance Act (FISA)
Which of the following has provided standards and best practices for managing electronic discovery compliance through data retention policies?
A. “E-discovery” rules
B. The Hague Convention on the Taking of Evidence
C. The Sedona Conference
D. The GDPR
C. The Sedona Conference
What are the key privacy protections of HIPAA’s Privacy Rule?
The HIPAA Privacy Rule was developed in 2000, revised in 2002 and modified in 2013 to implement amendments under HITECH (discussed further in this module)
- • Covered entities must provide detailed privacy notice at the date of first service delivery
- Uses or disclosures outside of HIPAA’s guidelines require opt-in authorization
- Use and disclosure of PHI for situations other than treatment is limited
- Individuals have the right to access and copy their own PHI from a covered entity and to amend their PHI
True or false?
Data destruction requirements are often built into state data security laws
False
Read the scenario and determine if it qualifies as an exception or non-exception to FERPA’s non-consensual disclosure rules:
- A late afternoon structural fire has blocked access to a road where several students reside, making it unsafe for them to return to their homes after school until the situation has been resolved. A parent volunteer at the school assists in accessing school records to determine which students are affected so that alternative arrangements can be made for their safety.
ANSWER: Disclosure allowed: As threat of harm is articulable and significant, information can be disclosed to any individual with the ability to assist in the situation
