CIPP / US Glossary

Question 1

Accountability

Answer 1

The implementation of appropriate technical and organisational measures to ensure and be able to demonstrate that the handling of personal data is performed in accordance with relevant law, an idea codified in the EU General Data Protection Regulation and other frameworks, including APEC’s Cross Border Privacy Rules

Question 2

Adequate Level of Protection

Answer 2

Elements:

(a) the rule of law, respect for human rights and fundamental freedoms, both general and sectoral legislation, data protection rules, professional rules and security measures, effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data is being transferred;
(b) the existence and effective functioning of independent supervisory authorities with responsibility for ensuring and enforcing compliance with the data protection rules;
(c) the international commitments the third country or international organisation concerned has entered into in relation to the protection of personal data

Question 3

Adverse Action

Answer 3

Under the Fair Credit Reporting Act, the term “adverse action” is defined very broadly to include all business, credit and employment actions affecting consumers that can be considered to have a negative impact, such as denying or canceling credit or insurance, or denying employment or promotion. No adverse action occurs in a credit transaction where the creditor makes a counteroffer that is accepted by the consumer. Such an action requires that the decision maker furnish the recipient of the adverse action with a copy of the credit report leading to the adverse action

Question 4

American Institute of Certified Public Accountants

Answer 4

A U.S. professional organization of certified public accountants and co-creator of the WebTrust seal program

Question 5

Americans with Disabilities Act

Answer 5

A U.S. law that bars discrimination against qualified individuals with disabilities

Question 6

Anti-discrimination Laws

Answer 6

Anti-discrimination laws are indications of special classes of personal data. If there exists law protecting against discrimination based on a class or status, it is likely personal information relating to that class or status is subject to more stringent data protection regulation, under the GDPR or otherwise

Question 7

APEC Privacy Principles

Answer 7

A set of non-binding principles adopted by the Asia-Pacific Economic Cooperative (APEC) that mirror the OECD Fair Information Privacy Practices. Though based on OECD Guidelines, they seek to promote electronic commerce throughout the Asia-Pacific region by balancing information privacy with business needs

Question 8

Background Screening/Checks

Answer 8

Organizations may want to verify an applicant’s ability to function in the working environment as well as assuring the safety and security of existing workers. Background checks range from checking a person’s educational background to checking on past criminal activity. Employee consent requirements for such check vary by member state and may be negotiated with local works councils

Question 9

Bank Secrecy Act

Answer 9

A U.S. federal law that requires U.S. financial institutions and money services businesses (MSBs), which are entities that sell money orders or provide cash transfer services, to record, retain and report certain financial transactions to the federal government. This requirement is meant to assist the government in the investigation of money laundering, tax evasion, terrorist financing and various other domestic and international criminal activities

Question 10

Behavioral Advertising

Answer 10

Advertising that is targeted at individuals based on the observation of their behaviour over time.
• Most often done via automated processing of personal data, or profiling, GDPR requires that data subjects be able to opt-out of any automated processing, to be informed of the logic involved in any automatic personal data processing and, at least when based on profiling, be informed of the consequences of such processing
• If cookies are used to store or access information for the purposes of behavioral advertising, the ePrivacy Directive requires that data subjects provide consent for the placement of such cookies, after having been provided with clear and comprehensive information

Question 11

Binding Corporate Rules

Answer 11

Binding Corporate Rules (BCRs) are an appropriate safeguard allowed by GDPR to facilitate cross-border transfers of personal data between the various entities of a corporate group worldwide. They do so by ensuring that the same high level of protection of personal data is complied with by all members of the organizational group by means of a single set of binding and enforceable rules. BCRs compel organizations to be able to demonstrate their compliance with all aspects of applicable data protection legislation and are approved by a member state data protection authority. To date, relatively few organizations have had BCRs approved

Question 12

Binding Safe Processor Rules

Answer 12

Previously, the EU distinguished between Binding Corporate Rules for controllers and Binding Safe Processor Rules for processors. With the General Data Protection Regulation, there is now no distinction made between the two in this context and Binding Corporate Rules are appropriate for both

Question 13

Breach Disclosure

Answer 13

The requirement that an organization notify regulators and/or victims of incidents affecting the confidentiality and security of personal data. The requirements in this arena vary wildly by jurisdiction. It is a transparency mechanism that highlights operational failures, which helps mitigate damage and aids in the understanding of causes of failure

Question 14

Bring Your Own Device

Answer 14

Use of employees’ own personal computing devices for work purposes

Question 15

California Investigative Consumer Reporting Agencies Act

Answer 15

A California state law that requires employers to notify applicants and employees of their intention to obtain and use a consumer report

Question 16

Case Law

Answer 16

Principles of law that have been established by judges in past decisions. When similar issues arise again, judges look to the past decisions as precedents and decide the new case in a manner that is consistent with past decisions

Question 17

CCTV

Answer 17

Originally an acronym for “closed circuit television,” CCTV has come to be shorthand for any video surveillance system. Originally, such systems relied on coaxial cable and was truly only accessible on premise. Today, most surveillance systems are hosted via TCP/IP networks and can be accessed remotely, and the footage much more easily shared, eliciting new and different privacy concerns

Question 18

Children’s Online Privacy Protection Act (COPPA) of 1998

Answer 18

U.S. federal law that applies to the operators of commercial websites and online services that are directed to children under the age of 13. It also applies to general audience websites and online services that have actual knowledge that they are collecting personal information from children under the age of 13.

COPPA requires these website operators to: (1) post a privacy notice on the homepage of the website;

(2) provide notice about collection practices to parents;
(3) obtain verifiable parental consent before collecting personal information from children;
(4) give parents a choice as to whether their child’s personal information will be disclosed to third parties;
(5) provide parents access and the opportunity to delete the child’s personal information and opt out of future collection or use of the information,
(6) and maintain the confidentiality, security and integrity of personal information collected from children.

Question 19

Choice

Answer 19

In the context of consent, choice refers to the idea that consent must be freely given and that data subjects must have a genuine choice as to whether to provide personal data or not. If there is no true choice it is unlikely the consent will be deemed valid under the General Data Protection Regulation

Question 20

Cloud Computing

Answer 20

The provision of information technology services over the Internet. These services may be provided by a company for its internal users in a “private cloud” or by third-party suppliers. The services can include software, infrastructure (i.e., servers), hosting and platforms (i.e., operating systems). Cloud computing has numerous applications, from personal webmail to corporate data storage, and can be subdivided into different types of service models

Question 21

Collection Limitation

Answer 21

A fair information practices principle, it is the principle stating there should be limits to the collection of personal data, that any such data should be obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject

Question 22

Commercial Activity

Answer 22

Under Canada’s PIPEDA, “commercial activity” means any particular transaction, act or conduct, or any regular course of conduct, that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists. Non-profit associations, unions and private schools are likely to be found to exist outside of this definition

Question 23

Commercial Electronic Message

Answer 23

Any form of electronic messaging, including e-mail, SMS text messages and messages sent via social networking about which it would be reasonable to conclude its purpose is to encourage participation in a commercial activity. Examples include electronic messages that offer to purchase, sell, barter or lease products, goods, services, land or an interest or right in land; offers to provide a business, investment or gaming opportunity; advertises or promotes anything previously mentioned.

Question 24

Common Law

Answer 24

Unwritten legal principles that have developed over time based on social customs and expectations.

Question 25

Communications Privacy

Answer 25

One of the four classes of privacy, along with information privacy, bodily privacy and territorial privacy. It encompasses protection of the means of correspondence, including postal mail, telephone conversations, electronic e-mail and other forms of communicative behavior and apparatus

Question 26

Comprehensive Laws

Answer 26

Laws that govern the collection, use and dissemination of personal information in the public and private sectors

Question 27

Computer Forensics

Answer 27

The discipline of assessing and examining an information system for relevant clues even after it has been compromised by an exploit

Question 28

Confidentiality

Answer 28

Data is “confidential” if it is protected against unauthorised or unlawful processing. The General Data Protection Regulation requires that an organization be able to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services as part of its requirements for appropriate security. In addition, the GDPR requires that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

Question 29

Confirmed Opt-In

Answer 29

An email approach where email marketers send a confirmation email requiring a response from the subscriber before the subscriber receives the actual marketing e-mail

Question 30

Consent

Answer 30

One of the fair information practices. Individuals must be able to prevent the collection of their personal data unless the disclosure is required by law. If an individual has a choice about the use or disclosure of his or her information, consent is the individual’s way of giving permission for the use or disclosure.

Consent may be affirmative; i.e., opt-in; or implied; i.e., the individual didn’t opt-out.

(1) Affirmative/Explicit Consent: A requirement that an individual “signifies” his or her agreement with a data controller by some active communication between the parties.
(2) Implicit Consent: Implied consent arises where consent may reasonably be inferred from the action or inaction of the individual.

Question 31

Consent Decree

Answer 31

A judgment entered by consent of the parties. Typically, the defendant agrees to stop alleged illegal activity and pay a fine, without admitting guilt or wrongdoing. This legal document is approved by a judge and formalizes an agreement reached between a U.S. federal or state agency and an adverse party

Question 32

Consumer Financial Protection Bureau

Answer 32

Created by the Dodd-Frank Act, the consumer financial protection bureau is intended to consolidate the oversight of the financial industry. It is an independent bureau within the Federal Reserve and when it was created CFPB took rule-making authority over FCRA and GLBA regulations from the FTC and Financial Industry Regulators. Its enforcement powers include authority to take action against “abusive acts and practices” as specified by the Dodd-Frank Act

Question 33

Consumer Reporting Agency

Answer 33

Any person or entity that complies or evaluates personal information for the purpose of furnishing consumer reports to third parties for a fee.

Question 34

Cookie

Answer 34

A small text file stored on a client machine that may later be retrieved by a web server from the machine. Cookies allow web servers to keep track of the end user’s browser activities, and connect individual web requests into a session. Cookies can also be used to prevent users from having to be authorized for every password protected page they access during a session by recording that they have successfully supplied their username and password already. Cookies may be referred to as “first-party” (if they are placed by the website that is visited) or “third-party” (if they are placed by a party other than the visited website)

Question 35

Credit Freeze

Answer 35

A consumer-initiated security measure which locks an individual’s data at consumer reporting agencies. Is used to prevent identity theft, as it disallows both reporting of data and issuance of new credit

Question 36

Credit Reporting Agency

Answer 36

Under the Fair Credit Reporting Act, any organization that regularly engages in assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties for a fee

Question 37

Customer Access

Answer 37

A customer’s ability to access the personal information collected on them as well as review, correct or delete any incorrect information

Question 38

Customer Information

Answer 38

In contrast to employee information, customer information includes data relating to the clients of private-sector organizations, patients within the healthcare sector and the general public within the context of public-sector agencies that provide services

Question 39

Data Breach

Answer 39

The unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a data collector. Breaches do not include good faith acquisitions of personal information by an employee or agent of the data collector for a legitimate purpose of the data collector—provided the personal information is not used for a purpose unrelated to the data collector’s business or subject to further unauthorized disclosure

Question 40

Data Classification

Answer 40

A scheme that provides the basis for managing access to, and protection of, data assets

Question 41

Data Controller

Answer 41

The natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by EU or member state law, the controller or the specific criteria for its nomination may be provided for by EU or member state law

Question 42

Data Elements

Answer 42

A unit of data that cannot be broken down further or has a distinct meaning. This may be a date of birth, a numerical identifier, or location coordinates. In the context of data protection, it is important to understand that data elements in isolation may not be personal data but, when combined, become personally identifiable and therefore personal data

Question 43

Data Matching

Answer 43

An activity that involves comparing personal data obtained from a variety of sources, including personal information banks, for the purpose of making decisions about the individuals to whom the data pertains

Question 44

Data Processing

Answer 44

Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction

Question 45

Data Processor

Answer 45

A natural or legal person (other than an employee of the controller), public authority, agency or other body which processes personal data on behalf of the controller. An organization can be both a controller and a processor at the same time, depending on the function the organization is performing

Question 46

Data Quality

Answer 46

A fair information practices principle, it is the principle that personal data should be relevant to the purposes for which it is to be used, and, to the extent necessary for those purposes, should be accurate, complete and kept up-to-date.

The quality of data is judged by 4 criteria:
(1) Is it accurate?
(2) Does it meet the business needs?
(3) Is it complete?
(4) Is it recent?
» Data is of an appropriate quality if these criteria are satisfied for a particular application

Question 47

Data Recipient

Answer 47

A natural or legal person, public authority, agency or another body, to which personal data is disclosed, whether a third party or not.

Exception: Public authorities that receive personal data in the framework of a particular inquiry in accordance with EU or member state law shall not be regarded as recipients.
• The processing of that data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing

Question 48

Data Subject

Answer 48

An identified or identifiable natural person

Question 49

Deceptive Trade Practices

Answer 49

In the context of U.S. federal law, a term associated with corporate entities who mislead or misrepresent products or services to consumers and customers. These practices are regulated in the U.S. by the Federal Trade Commission at the federal level and typically by an attorney general or office of consumer protection at the state level. Law typically provides for both enforcement by the government to stop the practice and individual actions for damages brought by consumers who are hurt by the practices

Question 50

Defamation

Answer 50

Common law tort focuses on a false or defamatory statement, defined as a communication tending “so to harm the reputation of another as to lower him in the estimation of the community or to deter third persons from associating or dealing with him.”

Question 51

Digital Fingerprinting

Answer 51

The use of log files to identify a website visitor. It is often used for security and system maintenance purposes. Log files generally include: the IP address of the visitor; a time stamp; the URL of the requested page or file; a referrer URL, and the visitor’s web browser, operating system and font preferences. In some cases, combining this information can be used to “fingerprint” a device

Question 52

Digital Signature

Answer 52

A means for ensuring the authenticity of an electronic document, such as an e-mail, text file, spreadsheet or image file. If anything is changed in the electronic document after the digital signature is attached, the signature is rendered invalid

Question 53

Direct Marketing

Answer 53

When the seller directly contacts an individual, in contrast to marketing through mass media such as television or radio

Question 54

Do Not Track

Answer 54

A proposed regulatory policy, similar to the existing Do-Not-Call Registry in the United States, which would allow consumers to opt out of web-usage tracking

Question 55

Do-Not-Call Implementation Act of 2003

Answer 55

Grants the authority to the FTC to create the National Do-Not-Call Registry in the United States. The registry is open to all consumers, allowing them to place their phone numbers on a national list which makes it illegal for telemarketers to make unsolicited calls to those numbers, the only exceptions being for political activities and non-profit organizations.

Originally consumers would have to re-register their numbers with the FTC every 5 years for continued prevention, but the Do-Not-Call Improvement Act of 2007 extended registration indefinitely. Violations can be enforced by the FTC, Federal Communications Commission, and state attorneys general with up to a $16,000 fine per violation

Question 56

Do-Not-Call Improvement Act of 2007

Answer 56

Amending the U.S. Do-Not-Call Implementation Act to remove the re-registration requirement. Originally registration with the National Do-Not-Call Registry ended after 5 years, but with this act the registrations became permanent

Question 57

Dodd-Frank Wall Street Reform and Consumer Protection Act

Answer 57

In 2010 the U.S. Congress passed the Dodd-Frank Act to reorganize and improve financial regulation. Among other reforms it put in place, the Dodd-Frank Act created the Consumer Financial Protection Bureau and granted it rule-making authority over FCRA and GLBA as well as a few other regulations

Question 58

Electronic Communications Privacy Act of 1986

Answer 58

The collective name of the Electronic Communications Privacy and Stored Wire Electronic Communications Acts, which updated the Federal Wiretap Act of 1968. ECPA, as amended, protects wire, oral and electronic communications while those communications are being made, are in transit, and when they are stored on computers.

The act applies to e-mail, telephone conversations and data stored electronically. The USA PATRIOT Act and subsequent federal enactments have clarified and updated ECPA in light of the ongoing development of modern communications technologies and methods, including easing restrictions on law enforcement access to stored communications in some cases

Question 59

Electronic Discovery

Answer 59

Prior to trial, information is typically exchanged between parties and their attorneys. E-discovery requires civil litigants to turn over large volumes of a company’s electronic records in litigation

Question 60

Electronic Health Record

Answer 60

A computer record of an individual’s medical file that may be shared across multiple healthcare settings. In some cases this sharing can occur by way of network-connected enterprise-wide information systems and other information networks or exchanges. EHRs may include a range of data including demographics, medical history, medication and allergies, immunization status, laboratory test results, radiology images, vital signs, personal stats such as age and weight and billing information. Their accessibility and standardization can facilitate large-scale data collection for researchers

Question 61

Electronic Surveillance

Answer 61

Monitoring through electronic means; i.e., video surveillance, intercepting communications, stored communications or location-based services

Question 62

Employee Information

Answer 62

Personal information reasonably required by an organization that is collected, used or disclosed solely for the purposes of establishing, managing or terminating; (1) an employment relationship, or (2) a volunteer work relationship between the organization and the individual but does not include personal information about the individual that is unrelated to that relationship

Question 63

Employment at Will

Answer 63

An employment contract can be terminated by either the employer or the employee at any time for any reason

Question 64

Equal Employment Opportunity Commission (EEOC)

Answer 64

An independent U.S. federal agency that enforces laws against workplace discrimination. The EEOC investigates discrimination complaints based on an individual’s race, color, national origin, religion, sex, age, perceived intelligence, disability and retaliation for reporting and/or opposing a discriminatory practice. It is empowered to file discrimination suits against employers on behalf of alleged victims and to adjudicate claims of discrimination brought against federal agencies

Question 65

Established Business Relationship

Answer 65

An exemption to the Do Not Call (DNC) registry, a marketer may call an individual on the DNC registry if a prior or existing relationship formed by a voluntary two-way communication between a person or entity and a residential subscriber with or without an exchange of consideration, on the basis of an inquiry, application, purchase or transaction by the residential subscriber regarding products or services offered by such person or entity, which relationship has not been previously terminated by either party

Question 66

EU Data Protection Directive

Answer 66

The EU Data Protection Directive (95/46/EC) was replaced by the General Data Protection Regulation in 2018. The Directive was adopted in 1995, became effective in 1998 and was the first EU-wide legislation that protected individuals’ privacy and personal data use

Question 67

EU-U.S. Safe Harbor Agreement

Answer 67

An agreement between the European and United States, invalidated by the Court of Justice of the European Union in 2015, that allowed for the legal transfer of personal data between the EU and U.S. in the absence of a comprehensive adequacy decision for the United States (see Adequacy). It was replaced by the EU-U.S. Privacy Shield in 2016 (see Privacy Shield)

Question 68

EU-US Privacy Shield

Answer 68

Created in 2016 to replace the invalidated EU-U.S. Safe Harbor agreement, the Privacy Shield is an adequacy agreement that allows for the transfer of personal data from the EU to the United States for companies participating in the program. Only those companies that fall under the jurisdiction of the U.S. Federal Trade Commission may certify to the Shield principles and participate, which notably excludes health care, financial services, and non-profit institutions

Question 69

European Commission

Answer 69

The executive body of the European Union. Its main function is to implement the EU’s decisions and policies, along with other functions. It initiates legislation in the EU, proposing initial drafts that are then undertaken by the Parliament and Council of the European Union. It is also responsible for making adequacy determinations with regard to data transfers to third-party countries

Question 70

Fair and Accurate Credit Transactions Act of 2003

Answer 70

• Expanded the Fair Credit Reporting Act (focuses on consumer access and identity theft prevention)
• Mandates that credit reporting agencies allow consumers to obtain a free credit report once every 12 months
• Allows consumers to request alerts when a creditor suspects identity theft and gave the FTC authority to promulgate rules to prevent identity theft&raquo_space; FTC used the authority to create the Red Flags Rule
• Stricter state laws are preempted in most areas although states retain some powers are preempted in most areas, although states retain some powers to enact laws addressing identity theft
• Required truncation of credit and debit card numbers, so that receipts do not reveal the full credit or debit card number

Question 71

Fair Credit Reporting Act

Answer 71

• Enacted to regulate the consumer reporting industry and provide privacy rights in consumer reports
• Mandates accurate and relevant data collection, provides consumers w/ ability to access and correct their info, and limits the use if consumer reports to defined permissible purposes
• Regulates “consumer reporting agency” that furnishes a “consumer report,” which is used primarily for assisting in establishing consumer’s eligibility for credit
• Users must:
(1) 3rd party data for substantive decision making must be appropriately accurate, current, and complete
(2) Consumers must receive notice when 3rd party data is used to make adverse decisions about them
(3) Consumer reports may be used only for permissible purposes
(4) Consumers must have access to their consumer reports and an opportunity to dispute them or correct any errors

Question 72

Federal Communications Commission (FCC)

Answer 72

The United States agency that regulates interstate communications through radio, wire, telecommunications, satellite and cable. The Federal Communications Commission has authority that overlaps with the Federal Trade Commission in some areas of privacy law including enforcement and further regulation under the Telephone Consumer Protection Act

Question 73

Federal Trade Commission (FTC)

Answer 73

• The United States’ primary consumer protection agency
• Collects complaints about companies, business practices and identity theft under the FTC Act and other laws that they enforce or administer
• The FTC brings actions under Section 5 of the FTC Act, which prohibits unfair and deceptive trade practices

Question 74

Financial Industry Regulatory Authority (FINRA)

Answer 74

• A corporation that acts as a regulator for brokerage firms and exchange markets
• Its primary charge is to make sure that security exchange markets, such as the New York Stock Exchange, operate fairly and honestly and to protect investors
• Although it is a non-governmental regulator, ultimately it is subject to the regulations of the Securities and Exchange Commission along with the rest of the security exchange industry

Question 75

Financial Institutions Reform, Recovery, and Enforcement Act of 1989 (FIRREA)

Answer 75

After the savings and loans crisis of the 1980s, the U.S Congress passed FIRREA to enable financial regulators to levy penalties up to $5,000,000 for failure to comply with regulations. These penalties can be levied if a Financial institution fails to comply with the information privacy requirements contained in GLBA

Question 76

Freedom of Information Act

Answer 76

A U.S. federal law that ensures citizen access to federal government agency records. FOIA only applies to federal executive branch documents. It does not apply to legislative or judicial records. FOIA requests will be fulfilled unless they are subject to nine specific exemptions. Most states have some state-level equivalent of FOIA. The federal and most state FOIA statutes include a specific exemption for personal information so that sensitive data (such as Social Security numbers) are not disclosed

Question 77

GET Method

Answer 77

The GET and POST HTML method attributes specify how form data is sent to a web page. The GET method appends the form data to the URL in name/value pairs allowing passwords and other sensitive information collected in a form to be visible in the browser’s address bar, and is thus less secure than the POST method

Question 78

Global Privacy Enforcement Network

Answer 78

• Organized following an OECD recommendation for cooperation among member countries on enforcement of privacy laws
• GPEN is collection of data protection authorities dedicated to discussing aspects of privacy law enforcement cooperation, the sharing of best practices, development of shared enforcement priorities, and the support of joint enforcement initiatives and awareness campaigns
• As of 2018, GPEN counted 50 member countries

Question 79

Gramm-Leach-Bliley Act

Answer 79

• Aka Financial Services Modernization Act of 1999
• Re-organized financial services regulation in the United States and applies broadly to any company that is “significantly engaged” in financial activities in the U.S.
• In its privacy provisions, GLBA addresses the handling of non-public personal information, defined broadly to include a consumer’s name and address, and consumers’ interactions with banks, insurers and other financial institutions
• Requires financial institutions to securely store personal financial information; give notice of their policies regarding the sharing of personal financial information, and give consumers the ability to opt-out of some sharing of personal financial information

Question 80

Health Breach Notification Rule

Answer 80

A rule in the United States, promulgated under HITECH, requiring vendors of personal health records and related entities to notify consumers when the security of their individually identifiable health information has been breached

Question 81

Health Information Technology for Economic and Clinical Health Act (HITECH)

Answer 81

Enacted as part of the American Recovery and Reinvestment Act of 2009, the HITECH Act, among other objectives, further addresses privacy and security issues involving PHI as defined by HIPAA. The HITECH privacy provisions include the introduction of categories of violations based on culpability that, in turn, are tied to tiered ranges of civil monetary penalties. Its most noteworthy elements elaborate upon breach notifications resulting from the use or disclosure of information that compromises its security or privacy

Question 82

Health Insurance Portability and Accountability Act (HIPAA)

Answer 82

A U.S. law passed to create national standards for electronic healthcare transactions, among other purposes. HIPAA required the U.S. Department of Health and Human Services to promulgate regulations to protect the privacy and security of personal health information. The basic rule is that patients have to opt in before their information can be shared with other organizations—although there are important exceptions such as for treatment, payment and healthcare operations

Question 83

Information Life Cycle

Answer 83

The information life cycle recognizes that data has different value, and requires approaches, as it moves through an organization from collection to deletion. The stages are generally considered to be: Collection, processing, use, disclosure, retention, and destruction

Question 84

Information Privacy

Answer 84

One of the four classes of privacy, along with territorial privacy, bodily privacy, and communications privacy. The claim of individuals, groups or institutions to determine for themselves when, how and to what extent information about them is communicated to others

Question 85

Information Security

Answer 85

The protection of information for the purposes of preventing loss, unauthorized access and/or misuse. It is also the process of assessing threats and risks to information and the procedures and controls to preserve confidentiality, integrity and availability of information

Question 86

Junk Fax Prevention Act of 2005

Answer 86

Creates the Existing Business Relationship exception to the U.S. Telephone Consumer Protection Act’s ban of fax-based marketing without consent but contains a requirement that all marketing faxes be accompanied by instructions on how to opt-out of further unsolicited communications

Question 87

Jurisdiction

Answer 87

The authority of a court to hear a particular case. Courts must have jurisdiction over both the parties to the dispute (personal jurisdiction) and the type of dispute (subject matter jurisdiction). The term is also used to denote the geographical area or subject-matter to which such authority applies

Question 88

Location-Based Service

Answer 88

Services that utilize information about location to deliver, in various contexts, a wide array of applications and services, including social networking, gaming and entertainment. Such services typically rely upon GPS, RFID, Wi-Fi, or similar technologies in which geolocation is used to identify the real-world geographic location of an object, such as a mobile device or an internet-connected computer terminal

Question 89

Medical Information

Answer 89

Information or records obtained, with the consent of the individual to whom it relates, from licensed physicians or medical practitioners, hospitals, clinics or other medical or medically related facilities

Question 90

Minimum Necessary Requirement

Answer 90

Under HIPAA, the standard that the level of information that may be disclosed by healthcare providers to third parties is the minimum amount necessary to accomplish the intended purpose

Question 91

Multi-Factor Authentication

Answer 91

An authentication process that requires more than one verification method (see Authentication), such as a password and biometric identifier, or log-in credentials and a code sent to an email address or phone number supplied by a data subject

Question 92

National Do-Not-Call Registry (U.S.)

Answer 92

Allows U.S. consumers to place their phone number on a national list, preventing calls from unsolicited telemarketers. This registration is now permanent and can be enforced by the Federal Trade Commission, Federal Communication Commission and state attorneys general with up to a $16,000 fine (book says $40,654 per violation). Cell phones are protected from any unsolicited automatic-dialed calls through other FCC regulations

Question 93

National Labor Relations Board

Answer 93

A U.S. federal agency that administers the National Labor Relations Act. The board conducts elections to determine if employees want union representation and investigates and remedies unfair labor practices by employers and unions

Question 94

National Security Letter

Answer 94

A category of subpoena. The USA PATRIOT Act expanded the use of national security letters. Separate and sometimes differing statutory provisions now govern access, without a court order, to communication providers, financial institutions, consumer credit agencies, and travel agencies

Question 95

Negligence

Answer 95

An organization will be liable for damages if it breaches a legal duty to protect personal information and an individual is harmed by that breach

Question 96

Non-Public Personal Information

Answer 96

Defined by GLBA as personally identifiable financial information:
• Provided by a consumer to a financial institution,
• Resulting from a transaction or service performed for the consumer,
• Otherwise obtained by the financial institution.

Excludes:

(i) publicly available information
(ii) any consumer list that is derived without using personally identifiable financial information

Question 97

OECD Guidelines

Answer 97

First released in 1980, and then updated in 2013, these guidelines represent perhaps the most widely accepted and circulated set of internationally agreed upon privacy principles along with guidance for countries as they develop regulations surrounding cross-border data flows and law-enforcement access to personal data.

The principles, widely emulated in national privacy laws, include Collection Limitation, Data Quality, Purpose Specification, Use Limitation, Security Safeguards, Openness, Individual Participation, and Accountability (see entries for each principle under their own listing elsewhere in the glossary)

Question 98

Omnibus Laws

Answer 98

Used to distinguish from sectorial laws (see Sectorial Laws), to mean laws that cover a broad spectrum of organizations or natural persons, rather than simply a certain market sector or population

Question 99

Online Behavioral Advertising

Answer 99

Websites or online advertising services that engage in the tracking or analysis of search terms, browser or user profiles, preferences, demographics, online activity, offline activity, location data, etc., and offer advertising based on that tracking

Question 100

Opt-In

Answer 100

One of two central concepts of choice. It means an individual makes an active affirmative indication of choice; i.e., checking a box signaling a desire to share his or her information with third parties

Question 101

Opt-Out

Answer 101

One of two central concepts of choice. It means an individual’s lack of action implies that a choice has been made; i.e., unless an individual checks or unchecks a box, their information will be shared with third parties

Question 102

Organization for Economic Cooperation and Development (OECD)

Answer 102

An international organization that promotes policies designed to achieve the highest sustainable economic growth, employment and a rising standard of living in both member and non-member countries, while contributing to the world economy

Question 103

Outsourcing

Answer 103

Contracting business processes, which may include the processing of personal information, to a third party

Question 104

PCI Data Security Standard (PCI-DSS)

Answer 104

A self-regulatory system that provides an enforceable security standard for payment card data. The rules were drafted by the Payment Card Industry Security Standards Council, which built on previous rules written by the various credit card companies. Except for small companies, compliance with the standard requires hiring a third party to conduct security assessments and detect violations. Failure to comply can lead to exclusion from Visa, MasterCard or other major payment card systems, as well as penalties

Question 105

Perimeter Controls

Answer 105

Technologies and processes that are designed to secure an entire network environment by preventing penetration from the outside

Question 106

Personal Data

Answer 106

The predominant term for Personal Information in the European Union, defined broadly in the General Data Protection Regulation as any information relating to an identified or identifiable natural person

Question 107

Personal Information

Answer 107

A synonym for “personal data.” It is a term with particular meaning under the California Consumer Privacy Act, which defines it as information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer

Question 108

Polygraph

Answer 108

A device used for the purpose of rendering a diagnostic opinion regarding an individual’s honesty

Question 109

Employee Polygraph Protection Act of 1988 (EPPA)

Answer 109

• Prohibits employers from requiring or requesting that a prospective or current employee take a lie detector test
• Lie detector – polygraphs, voice stress, analyzers, psychology stress evaluators, or any similar device used for the purpose of rendering a diagnostic opinion re: an individual’s honesty
• Exceptions: tests are allowed in connection w/ an ongoing investigation (w/ reasonable suspicion) re: economic loss or injury to the employer’s business (e.g. theft, embezzlement, or industrial espionage)

Question 110

POST Method

Answer 110

The GET and POST HTML method attributes specify how form data is sent to a web page. The POST method is more secure than GET as the GET method appends the form data to the URL allowing passwords and other sensitive information collected in a form to be visible in the browser’s address bar

Question 111

Preemption

Answer 111

A superior government’s ability to have its law(s) supersede those of an inferior government. For example, the U.S. federal government has mandated that no state government can regulate consumer credit reporting

Question 112

Privacy Assessment

Answer 112

An assessment of an organization’s compliance with its privacy policies and procedures, applicable laws, regulations, service-level agreements, standards adopted by the entity and other contracts. The assessment or audit measures how closely the organization’s practices align with its legal obligations and stated practices and may rely on subjective information such as employee interviews/questionnaires and complaints received, or objective standards, such as information system logs or training and awareness attendance and test scores. Audits and assessments may be conducted internally by an audit function or by external third parties

Question 113

Privacy by Design

Answer 113

Generally regarded as a synonym for Data Protection by Design (see Data Protection by Design). However, Privacy by Design as a specific term was first outlined in a framework in the mid-1990s by then-Information and Privacy Commissioner of Ontario, Canada, Ann Cavoukian, with seven foundational principles

Question 114

Privacy Notice

Answer 114

A statement made to a data subject that describes how an organization collects, uses, retains and discloses personal information. A privacy notice may be referred to as a privacy statement, a fair processing statement or, sometimes, a privacy policy. Numerous global privacy and data protection laws require privacy notices

Question 115

Privacy Officer

Answer 115

A general term in many organizations for the head of privacy compliance and operations. In the United States federal government, however, it is a more specific term for the official responsible for the coordination and implementation of all privacy and confidentiality efforts within a department or component. This official may be statutorily mandated as a political appointment, as in the Department of Homeland Security, or a career professional

Question 116

Privacy Policy

Answer 116

An internal statement that governs an organization or entity’s handling of personal information. It is directed at those members of the organization who might handle or make decisions regarding the personal information, instructing them on the collection, use, storage and destruction of the data, as well as any specific rights the data subjects may have. May also be referred to as a data protection policy

Question 117

HIPAA Privacy Rule

Answer 117

• Establishes U.S. national standards to protect individuals’ medical records and other personal health information and applies to health plans, healthcare clearinghouses and those healthcare providers that conduct certain healthcare transactions electronically.
• Requires appropriate safeguards to protect the privacy of personal health information and sets limits and conditions on the uses and disclosures that may be made of such information without patient authorization.
• Gives patients’ rights over their health information, including rights to examine and obtain a copy of their health records and to request corrections

Question 118

Private Right of Action

Answer 118

Unless otherwise restricted by law, any individual that is harmed by a violation of the law can file a lawsuit against the violator

Question 119

Protected Health Information (PHI)

Answer 119

Any individually identifiable health information transmitted or maintained in any form or medium that is held by an entity covered by the Health Insurance Portability and Accountability Act or its business associate; identifies the individual or offers a reasonable basis for identification; is created or received by a covered entity or an employer; and relates to a past, present or future physical or mental condition, provision of healthcare or payment for healthcare to that individual

Question 120

Protective Order

Answer 120

With a protective order, a judge determines what information should not be made public and what conditions apply to who may access the protected information

Question 121

Public Records

Answer 121

Information collected and maintained by a government entity and available to the general public

Question 122

Publicity Given to Private Life

Answer 122

A U.S. common law tort that states: “One who gives publicity to a matter concerning the private life of another is subject to liability to the other for invasion of his privacy, if the matter publicized is of a kind that (a) would be highly offensive to a reasonable person and (b) is not of legitimate concern to the public.”

Question 123

Qualified Protective Order

Answer 123

Requires that the parties are prohibited from using or disclosing protected health information for any purpose other than the litigation and that the PHI will be returned or destroyed at the end of the litigation

Question 124

Radio-Frequency Identification

Answer 124

Technologies that use radio waves to identify people or objects carrying encoded microchips

Question 125

Random Testing

Answer 125

Substance testing sometimes required by law, prohibited in certain jurisdictions, but acceptable where used on existing employees in specific, narrowly defined jobs, such as those in highly regulated industries where the employee has a severely diminished expectation of privacy or where testing is critical to public safety or national security

Question 126

Re-identification

Answer 126

The action of reattaching identifying characteristics to pseudonymized or de-identified data (see De-identification and Pseudonymization) . Often invoked as a “risk of re-identification” or “re-identification risk,” which refers to nullifying the de-identification actions previously applied to data (see De-identification)

Question 127

Reasonable Suspicion

Answer 127

A determining factor in substance testing where testing is allowed as a condition of continued employment if there is “reasonable suspicion” of drug or alcohol use based on specific facts as well as rational inferences from those facts; i.e., appearance, behavior, speech, odors

Question 128

Rectification

Answer 128

An individual’s right to have personal data about them corrected or amended by a business or other organization if it is inaccurate.

Question 129

Red Flags Rule

Answer 129

A regulation created by the FTC under the authority of the Fair and Accurate Credit Transactions Act of 2003. This regulation requires financial institutions and creditors to implement measures to detect and prevent identity theft. The original FTC rule was circumscribed by the Red Flag Program Clarification Act of 2010, which limited the definition of “creditors” to exclude any creditor “that advances funds on the behalf of a person for expenses incidental to a service.” The act in effect allowed lawyers, some doctors and other service type companies to avoid implementing Red Flag credit measures

Question 130

Redaction

Answer 130

The practice of identifying and removing or blocking information from documents being produced pursuant to a discovery request or as evidence in a court proceeding. Specifically, attorneys are required to redact documents so that no more than the following information is included in court filings: (1) The last four digits of the Social Security number and taxpayer-identification number; (2) the year of the individual’s birth; (3) if the individual is a minor, only the minor’s initials, and (4) the last four digits of the financial account number

Question 131

Retention

Answer 131

Within the information life cycle, the concept that organizations should retain personal information only as long as necessary to fulfill the stated purpose

Question 132

Right of Access

Answer 132

An individual’s right to request and receive their personal data from a business or other organization

Question 133

Sarbanes-Oxley Act

Answer 133

A US law, passed in 2002, regulating the transparency of publicly held companies. In particular, public companies must establish a way for the company to confidentially receive and deal with complaints about actual or potential fraud from misappropriation of assets and/or material misstatements in financial reporting from so-called “whistle-blowers.”

Question 134

Seal Programs

Answer 134

Programs that require participants to abide by codes of information practices and submit to monitoring to ensure compliance. In return, companies that abide by the terms of the seal program are allowed to display the programs seal on their website

Question 135

Secret Key

Answer 135

A cryptographic key used with a secret key cryptographic algorithm, uniquely associated with one or more entities and which shall not be made public. The use of the term “secret” in this context does not imply a classification level, rather the term implies the need to protect the key from disclosure or substitution

Question 136

Sedona Conference

Answer 136

An important source of standards and best practices for managing electronic discovery compliance through data retention policies. Regarding email retention, the Sedona Conference offers four key guidelines:

(1) Email retention policies should be administered by interdisciplinary teams composed of participants across a diverse array of business units;
(2) such teams should continually develop their understanding of the policies and practices in place and identify the gaps between policy and practice;
(3) interdisciplinary teams should reach consensus as to policies while looking to industry standards;
(4) technical solutions should meet and parallel the functional requirements of the organization.

Question 137

Self-Regulation Model

Answer 137

Refers to stakeholder-based models for ensuring privacy. The term “self-regulation” can refer to any or all of three pieces: legislation, enforcement and adjudication.
• Legislation - who defines privacy rules? For self-regulation, this typically occurs through the privacy policy of a company or other entity, or by an industry association.
• Enforcement - who should initiate an enforcement action? Actions may be brought by data protection authorities, other government agencies, industry code enforcement, or in some cases, the affected individuals.
• Adjudication - who should decide whether an organization has violated a privacy rule. The decision-maker can be an industry association, a government agency or a judicial officer

Question 138

Semayne’s Case

Answer 138

A case recognized as establishing the “knock-and-announce rule,” an important concept relating to privacy in one’s home and Fourth Amendment search and seizure jurisprudence in the U.S.

Question 139

Smart Grid

Answer 139

An energy system that manages electricity consumption through continuous monitoring, remote computerization and automation. The traditional electric transmission system required physically sending workers into the field to periodically read customer meters and find where problems existed in the grid. Smart grid operators; however, can remotely monitor and control the use of electricity to each home or business

what eversource and national grid do once a month

Question 140

SPAM

Answer 140

Unsolicited commercial e-mail

Question 141

Controlling the Assault of Non-solicited Pornography and Marketing (CAN-SPAM) Act of 2003

Answer 141

• Prohibits false or misleading headers, deceptive subject lines, sending commercial email following a grace period of 10 business days who has not asked to receive future email
• Commercial emails must include clear
and conspicuous (1) notice of the opportunity to opt out along w/ a cost-free mechanism for exercising the opt-out, (2) identification that the message is a commercial message (unless recipient has provided prior affirmative consent to receive email), (3) a valid physical postal address of the sender, (4) a functioning, clearly and conspicuously displayed return email address that allows the recipient to contact sender
• Prohibits “aggravated violations” relating to commercial emails such as (1) address-harvesting and dictionary attacks, (2) automated creation of multiple email accounts and (3) the retransmission of commercial email through unauthorized accounts
• Commercial email containing sexually oriented material must include a warning label (unless the recipient has provided prior affirmative consent to receive the email)

Question 142

Special Categories of Data

Answer 142

As defined in Article 9 of the General Data Protection Regulation, personal information that reveals, for example, racial origin, political opinions or religious or other beliefs, as well as personal data that concerns health or sexual life or criminal convictions is considered to be in a special category and cannot be processed except under specific circumstances

Question 143

Stored Communications Act

Answer 143

The Stored Communications Act was enacted as part of Electronic Communications Privacy Act in 1986 in the United States. It generally prohibits the unauthorized acquisition, alteration or blocking of electronic communications while in electronic storage in a facility through which an electronic communications service is provided

Question 144

Subpoena

Answer 144

A written court order issued in an administrative, civil or criminal action that requires the person named in the subpoena to appear in court in order to testify under oath on a particular matter which is the subject of an investigation, proceeding or lawsuit. A subpoena may also require the production of a paper, document or other object relevant to an investigation, proceeding or lawsuit that discloses personal information

Question 145

Substance Testing

Answer 145

A screening to identify drug use. Substance testing can be used in a variety of settings such as preemployment, reasonable suspicion, routine testing, post-accident testing or randomly

Question 146

Confidentiality of Substance Use Disorder Patient Records Rule

Answer 146

• Scope of the rule covers the disclosure & use of “patient identifying” info by treatment programs for alcohol & substance abuse
• Applies to any program that receives federal funding
• Must obtain written patient consent before disclosing info subject to the rule
• Redisclosing info obtained from a program is prohibited when that info would “identify, directly or indirectly, an individual as having been diagnosed, treated, or referred for treatment

Question 147

Exceptions to the Confidentiality of Substance Use Disorder Patient Records Rule

Answer 147

• Medical emergencies
• Scientific research
• Audits and evaluations
• Communications w/ a qualified service related to info needed by the org to provide services to the program
• Crimes on program premises or against program personnel
• Child abuse reporting
• Court order

Question 148

Substitute Notice

Answer 148

Most legislation recognizes that data breach notifications involving thousands of impacted data subjects could place an undue financial burden on the organization and therefore allow substitute notification methods. In Connecticut, for example, “Substitute notice shall consist of the following: (A) Electronic mail notice when the person, business or agency has an electronic mail address for the affected persons; (B) conspicuous posting of the notice on the website of the person, business or agency if the person maintains one, and (C) notification to major state-wide media, including newspapers, radio and television.”

Question 149

Telephone Consumer Protection Act of 1991

Answer 149

• The first enactment of laws limiting unsolicited and automated telemarketing for both telephone and fax communications
• Creates a private right of action for those receiving unsolicited faxes, carrying a $500 fine per violation and any damages sustained because of the fax.
• Gives rule-making authority to the Federal Communications Commission, allowing it to make further regulations in this area
• Prevents faxing without consent from the recipient (this requirement was amended by the Junk Fax Prevention Act of 2005 to not include customers with an existing business relationship) and requires companies to create and honor internal do-not-call registries (in 2003 the National Registry was created by the FTC)

Question 150

Territorial Privacy

Answer 150

One of the four classes of privacy, along with information privacy, bodily privacy and communications privacy. It is concerned with placing limitations on the ability of one to intrude into another individual’s environment. Environment is not limited to the home; it may be defined as the workplace or public space and environmental considerations can be extended to an international level. Invasion into an individual’s territorial privacy typically comes in the form of video surveillance, ID checks and use of similar technology and procedures

Question 151

Transparency

Answer 151

Taking appropriate measures to provide any information relating to processing to the data subject in a concise, intelligible and easily accessible form, using clear and plain language

Question 152

U.S. Department of Labor

Answer 152

A U.S. federal agency that oversees “the welfare of the job seekers, wage earners and retirees of the United States by improving their working conditions, advancing their opportunities for profitable employment, protecting their retirement and healthcare benefits, helping employers find workers, strengthening free collective bargaining and tracking changes in employment, prices, and other national economic measurements.”
• To achieve this mission, the dept administers a variety of federal laws such as Fair Labor Standards Act (FLSA), Occupational Safety and Health Act (OSHA) and Employee Retirement Income Security Act (ERISA)

Question 153

Unfair Trade Practices

Answer 153

Commercial conduct that intentionally causes substantial injury, without offsetting benefits, and that consumers cannot reasonably avoid

Question 154

United States Department of Health, Education and Welfare Fair Information Practice Principles (1973)

Answer 154

A code of fair information practices that contains 5 principles:

(1) There must be no personal data record-keeping systems whose very existence is secret
(2) There must be a way for an individual to find out what information about him is in a record and how it is used
(3) There must be a way for an individual to prevent information about him that was obtained for one purpose from being used or made available for other purposes without his consent
(4) There must be a way for an individual to correct or amend a record of identifiable information about him
(5) Any organization creating, maintaining, using, or disseminating records of identifiable personal data must assure the reliability of the data for their intended use and must take precautions to prevent misuse of the data

Question 155

USA PATRIOT Act

Answer 155

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT ACT) Act of 2001 is a broad-ranging act designed to counter-terrorism that expanded U.S. law enforcement authority to surveillance and capturing communications and records. Commonly referred to as the Patriot Act

Question 156

Value-Added Services

Answer 156

A telecommunications industry term for non-core services (i.e., services beyond voice calls and fax transmissions)
More broadly, the term is used in the service sector to refer to services, which are available at little or no cost, and promote their primary business.
For mobile phones, while technologies like SMS, MMS and GPRS are usually considered value-added services, a distinction may also be made between standard (peer-to-peer) content and premium-charged content. These are called mobile value-added services (MVAS), which are often simply referred to as VAS.

Value-added services are supplied either in-house by the mobile network operator themselves or by a third-party value-added service provider (VASP), aka a content provider (CP) such as Headline News or Reuters. VASPs typically connect to the operator using protocols like short message peer-to-peer protocol (SMPP), connecting either directly to the short message service centre (SMSC) or, increasingly, to a messaging gateway that gives the operator better control of the content

Question 157

Video Surveillance

Answer 157

Recordings that do not have sound

Question 158

Voice Over Internet Protocol

Answer 158

A technology that allows telephone calls to be made over a LAN or the Internet itself. Skype is a well-known example. VoIP poses the same risk as network-connected PBX systems but also poses the additional risk of data interception when such data travel over an unsecured connection. VoIP functionality should be encrypted where possible and equipment monitored with intrusion-detection systems

Question 159

WebTrust

Answer 159

Created by the American Institute of Certified Public Accountants (AICPA) and the Canadian Institute of Chartered Accountants (CICA). It is a self-regulating seal program which licenses qualifying certified public accountants.

Question 160

Whistleblowing

Answer 160

If illegal or improper activity is taking place within an organization, employees may first observe it and report it to individuals with more authority or an agency outside of the organization. In setting up procedures to make it possible for an employee to report such activity, per laws in a variety of jurisdictions that protect the rights of these so-called whistleblowers, an organization will want to be sure that appropriate privacy safeguards are put in place