Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Tojasej > 4. Operations: Data Assessment > Flashcards

4. Operations: Data Assessment Flashcards

1
Q

What function do data assessments fulfill?

A
  1. Inventory, manage, and track PI
  2. Determine the impact organizational systems and processes will have on privacy
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the different types and functions of data assessments?

A
  1. Privacy Impact Assessment (PIA) - enterprise risk management function
  2. Data Protection Impact Assessment (DPIA) - compliance function
  3. Data Mapping Assessment (Data Inventory) - internal audit function
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is data?

A

A strategic asset, the lifeblood of organizations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the role of data governance?

A

It can:
1. Improve client value
2. Increase profitability
3. Manage risk
4. Deliver transformative initiates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is data governance defined as by the Data Managment Association (DAMA)?

A

The planning, oversight, and control over management of data and the use of data and data-related sources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What does a data governance framework provide?

A

A holistic approach to collecting, managing, securing, and storing data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What should data governance cover?

A

DAMA envisions data management as a wheel with data governance as a hub for:
1. Data Architecture - overall structure of data & data-related resources
2. Data Modeling and Design - analysis, design, building, testing, and maintenace
3. Data Storage and Operations - structured physical data assess storage deployment and management
4. Data Security - privacy, confidentiality and appropriate access
5. Data Integration and Interoperability - Aquisition, extraction, transformation, movement, delivery, replication, federation, virtualization, and operational support
6. Documents and Content - storing, protecting, indexing and enabling access to data found in unstructured sources and making this data available for integration
7. Reference and Master Data - Shared data management to reduce redundance
8. Data Warehousing and Business Intelligence - analytical data management and processing
9. Metadata - Collection, categorization, maintenance, integration, control, and management
10. Data Quality - definition, monitoring, data maintenance integrity, and data quality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the common data governance roles?

A
  1. Strategic: data steering committee formed by C-level individuals
  2. Managerial: data owners responsible for data domain or asset
  3. Operational: data stewards - subject matter experts accountable for the day-to-day management of data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a data inventory of data map?

A
  1. Identifies data as it moves across various systems
  2. Indicates how data is shared
  3. Identifies inconsistent data versions
  4. Enables identification and mitigation of data disparities
  5. Serves to identify the most and least valuable data
  6. Reveal how data is accessed, used, and stored.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the benefits of a data inventory?

A
  1. Identifies risks
  2. Reduces penalty - demonstrates that the company has an established system of recording and organizing the data inventory
  3. Resource allocation - prioritize resources, efforts, risk assessments, and current policy in response to incidents
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Who is responsible for the data inventory?

A

Privacy function and/or IT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the GDPR requirement under Article 30?

A

Maintain detailed records of processing activities. Records must include:
1. Name and contact detail of processor/controller/DPO
2. Name and contact of any joint controllers
3. Purpose for processing
4. Categories of PI and data subjects
5. Categories of recipients
6. International data transfers
7. Safeguards for exceptional transfers
8. Retention periods for the various categories of PI
9. Description of the technical and organizational security measures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Is it required to disclose the detailed record processing to the data protection authority?

A

Yes, unless the controller or processor employs fewer than 250 people, the processing is occasional, does not include sensitive data, and is not likely to result in a risk for the rights and freedoms of the individual.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is one starting point to a data processing inventory project?

A
  1. Identifying and interviewing all known data owners.

(Data custodians may be separate from data owners)

  1. Reach out to IT to obtain list of database administrators who should have schemas of the databases of varying kinds.
  2. Teams responsible for backups and business continuity should know what data is retained and what should be restored.
  3. The software team should have a list of all software used in the organization.
  4. The compliance team should have would have details of the personal data.
  5. Administrators that answer data subject access requests would also have information about personal data sources.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Does nonpersonal data need to be identified in a data inventory?

A

Anonymous data outside the scope of the GDPR does need to be identified.

Implementing a new process means that revised or new applications or systems must thoroughly document the personal data they are processing, this will keep the data inventory from becoming outdated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What additional data should be included in a data inventory?

A
  1. Security
  2. Data retention periods
  3. Who has access to the data
  4. To whom is data disclosed
  5. Legal basis for processing the data.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a privacy assessment?

A

A compliance measurement.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What do privacy assessments measure?

A

An organization’s compliance with laws, regulations, adopted standards, and internal policies and procedures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the scope of a privacy assessment?

A

It may include:
1. Education and awareness
2. Monitoring and reporting to the regulatory environment
3. Data systems and process assessments
4. Risk assessments
5. Incident response
6. Contracts
7. Remediation
8. Program assurance including audits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Who conducts a privacy assessment?

A

It may be conducted internally through the audit function, DPO, a business function or externally by a third party.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Why is a privacy assessment conducted?

A

In response to a security or privacy event or at the request of an enforcment authority.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is a privacy impact assessment (PIA)?

A

An analysis of the privacy risk associated with processing personal information in relation to a project, product or service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What should a PIA accomplish?

A

Should suggest or provide remedial actions or mitigations necessary to avoid or minimize risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How are the PIA requirements determined?

A

They emanate from industry codes, organizational policy, laws, regulations, or supervisory authority.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What can PIA help facilitate?

A

Privacy by Design (PbD) - building privacy directly into technology, systems, and practices at the design phase.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

When should a PIA be completed?

A

Early:

  1. During the ideation stage or scoping of a project, product or service that involves the collection of PI
  2. New or revised industry standards, organizational policies, or laws or regulations.
  3. When the organization create new privacy risks through changes to methods by which PI is handled.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What business processes might trigger a PIA?

A
  1. Re-identification
  2. Conversion of paper record to electronic format
  3. Significant merging, matching, and manipulation of multiple databases
  4. Application of user-authentication technology to publicly accessible system
  5. System management changes involving new technologies
  6. Retiring of systems
  7. Incorporation of PI obtained from commercial or public sources into existing databases
  8. Interagency exchanges or uses of PI
  9. Alteration of business processes (new collection, use, and disclosure of PI)
  10. Alteration of the character of PI
  11. Implementation of projects using third-party service providers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is an express PIA?

A

A small questionnaire that assesses the need for a full and more comprehensive PIA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Is a PIA required in the US?

A

Under the E-Government Act (2002), PIAs are required of government agencies when developing or procuring IT systems containing PII of the public or initiation the collection of PII.

The requirement is preceded by a privacy threshold analysis.

30
Q

What does a PIA entail under the Privacy Act in the US?

A

Information collected or maintained, sources of that information, uses and possible disclosures, and possible threats to the information.

31
Q

Under the Privacy Act in the US, what are the reasons for initiating a PIA?

A
  1. Collection of new information (compelled or voluntary)
  2. Conversion of records (paper to electronic)
  3. Conversion of information (anonymous to identifiable)
  4. System management changes (significant new uses or application of new technologies)
  5. Merging, matching, or other manipulation of databases
  6. Incorporation of PII obtained commercially or from public sources into databases
  7. New interagency exchanges of PII
  8. Alteration of a business process (new collection, use, or disclosure)
  9. Alteration of the character of PII
  10. Implementation of projects using third-party service providers.
32
Q

What US state law requires data protection assessments?

A

Virginia’s Consumer Data Protection Act (CDPA).

33
Q

Should a PIA continue after implementation?

A

Yes.

34
Q

What are the two phases of a PIA?

A

Preforming and follow-up.

35
Q

What are the preforming phase steps of a PIA?

A
  1. Identifying PI flows
  2. Analyzing the implications of the use case
  3. Determining the relevant privacy safeguarding-requirements
  4. Assessing privacy risks using steps of risk identification, analysis and evaluation
  5. Preparing to treat privacy risk
36
Q

What are the follow-up phase steps of a PIA?

A
  1. Preparing and publishing the PIA report
  2. Implementing the privacy risk treatment plan.
  3. Reviewing the PIA and reflecting changes to the process
37
Q

What sections should be included in a PIA?

A
  1. Scope of assessment
  2. Privacy requirements
  3. Risk assessment (discussion of risk sources, threats and likelihood, consequences and level of impact, risk evaluation, and compliance analysis)
  4. Risk treatment plan
  5. Conclusions and decisions

Summary should be made public.

38
Q

What is a Data Protection Impact Assessment (DPIA)?

A

It is an important tool for negating risk and demonstrating compliance with the GDPR.

(DPIA is required for processing that is likely to result in a high risk to individuals)

39
Q

What are to consequences for not completing a DPIA?

A
  • Failure to complete a DPIA
  • Carrying out a DPIA incorrectly
  • Failure to consult the competent supervisory authority …

… can result in GDPR fines of up to 10 M euros OR up to 2% of total global revenue for the financial year, whichever is higher.

40
Q

When is a DPIA required?

A

Processing is “likely to result in a high risk to the rights and freedoms of natural persons”.

41
Q

If a DPIA is not carried out, what are controllers required to do?

A

Justify and document the reasons for not carrying out a DPIA and include the views of the DPO.

42
Q

What are the minimum features set out by the GDPR for a DPIA?

A
  1. Description of the processing, including its purpose and the legitimate interest being pursued
  2. The necessity of processing, its proportionality, and the risks that it poses to data subjects
  3. Measures to address the risks identified
43
Q

What are the steps of a generic process for carrying out a DPIA?

A
  1. Description of the envisaged process
  2. Assessment of the necessity and proportionality
  3. Measures already envisaged
  4. Assessment of the risks to the rights and freedoms
  5. Measures envisaged to address the risks
  6. Documentation
  7. Monitoring and review
44
Q

When must a supervisory authority be contacted regarding a DPIA?

A

When the data controller cannot find sufficient measures to reduce the risks to an acceptable level.

45
Q

What is AI?

A

An umbrella term for a range of algorithm-based technologies that solve complex tasks by carrying out functions that previously required human thinking.

Decisions can be fully automated or have some form of human intervention

46
Q

Why is privacy commonly identified as one of the main pitfalls of AI?

A

AI commonly clashes with privacy principles:

  1. Lawfulness, fairness, and transparency
  2. Data minimization and purpose limitation
  3. Integrity and confidentiality (security)
47
Q

What should and AI system assessment include?

A
  1. Proven ability of the system to fulfill a specific and legitimate purpose
  2. Algorithmic inaccuracies or database bias (detriment to data subjects)
  3. Redress mechanisms against AI system decisions
  4. Consideration given to vulnerable groups and situations (power asymmetries)
  5. The elimination of socially contracted biases from datasets used to train AI
  6. Assurances that AI systems do not represent themselves as humans to data subjects
  7. Assessment of PI continued in training data
  8. Reduction of the likelihood of training data being tracked back to specific individuals
48
Q

What should an IA redress mechanism address and show?

A
  1. Entity accountable for the decision
  2. Explicable, reproducible, traceable, and auditable decision-making process
49
Q

What is the function of regular self-assessments?

A

Demonstrate a a responsible privacy management culture.

50
Q

What are the systems security categories described in the NIST 800-60

*National Institute of Standards and Technology

A
  1. Task - data clarification
  2. Owner
  3. Questions
  4. Evidence - spreadsheet with data inventory, categories, and classsification
51
Q

What are the controls that can preserve information integrity?

A
  1. Confidentiality - access to information is limited authorized parties
  2. Integrity - assurance that the data is authentic and complete
  3. Availability - knowledge that the data is accessible, as needed, by those that are authorized to use it
52
Q

How is information security achieved?

A

Through the implementation of controls that are monitored and reviewed

53
Q

What are security controls?

A

Mechanisms that prevent, detect, and correct a security incident.

54
Q

What are the three types of security controls?

A
  1. physical - protects personnel, equipment, and data
  2. administrative
  3. technical
55
Q

What are some examples of physical controls?

A
  1. Locks on physical document storage
  2. Protection of premises
  3. Electronic and paper waste disposal
56
Q

Why is vendor assessment important?

A

Under many privacy laws, organizations are liable for the data-processing activities conducted on their behalf by vendors.

57
Q

How should vendors be eveluated?

A

Against specific organizational standards and vendor selection processes:
- questionnaires
- PIAs
- checklists

58
Q

What are the good practice standards when selecting vendors?

A
  1. Reputation
  2. Financial condition and insurance
  3. Information security controls
  4. Point of transfer
  5. Disposal of information
  6. Employee training and user awareness
  7. Vendor incident response
  8. Audit rights
  9. Policies and procedures
  10. DPO
59
Q

When it comes to vendors, what elements should be included in contractual language?

A
  1. Specifics regarding the type of PI to which vendor will have access at remote locations
  2. Vendor plans to protect PI
  3. Vendor responsibilities in the event of a data breach
  4. Disposal of data upon contract termination
  5. Limitations on the use of data that ensure it will be used only for specified purposes
  6. Rights of audit and investigation
  7. Liability for data breach
60
Q

What is the purpose of a vendor contract?

A

Ensure compliance with the organization’s privacy program.

61
Q

What does the term cloud computing refer to?

A

Provision of information technology services over the internet.

Services can include software, server infrastructure, hosting, and operating system platforms.

Has numerous applications: personal webmail, corporate data storage, etc.

62
Q

What are the cloud computing service models?

A
  1. Infrastructure as a service - supplier provides remote access to and use of physical computing resources, the user is responsible for implementing and maintaining operating platforms and applications
  2. Platform as a service - supplier provides access to and use of operating platforms and hardware and the user remains responsible for implementing and maintaining applications
  3. Software as a service - supplier provides the infrastructure, platform and application
63
Q

What are the recommendations put forward by the Cloud Computing Forum to assess cloud computing vendors?

A
  1. Certifications and standards - ISO 27001 or the UK’s government’s Cyber Essentials Scheme
  2. Technologies - re-coding, customization, migration services
  3. Service road maps - innovation over time
  4. Data management - data storage jurisdiction
  5. Information security - internal security audits
  6. Subcontractors and service dependencies
  7. Data policies and protection
64
Q

Does the GDPR contain vendor assessment requirements?

A

Yes, article 28 contains specific provisions for the controller-processor relationship:

  1. Security requirements
  2. Sufficient guarantees (sufficient GDPR complaint
  3. Data right protections and proof of processor’s competence)
  4. Processor vetting by the supplier (assessment or certificate validation)
  5. Audit
  6. Duty to assist controller with achieving compliance and reduction of risk
  7. Assisting controller with the handling of personal data breach notification requirements
65
Q

What is required of the controller if it cannot establish proof of the processor’s competence?

A

Walk away, otherwise it will be in automatic breach of GDPR Article 28.

66
Q

What are the vendor assessment requirements under the California Consumer Privacy Act (CCPA)?

A
  1. Written contracts with specific criteria if liability is shifted to vendor for any violations caused by the vendor.
  2. If the vendor is a service provider, the contract must limit processing to the business purpose.
  3. If the vendor is defined as a person, the contract should prohibit the vendor from selling, retaining, using, or disclosing the PI outside the direct business relationship.
67
Q

Is the identification of third parties required under the CCPA?

A

Third parties with whom the business shares PI must be identified.

Categories of third parties with whom business shares PI must be disclosed to customers upon request.

68
Q

What is defined in Section 1798.140 (w) of the CPPA?

A

Not all vendors are considered to be third parties, and third parties are not the same as service providers.

Third parties have separate uses for the data that a business shares with them.

69
Q

What is defined in Section 1798.140 (a) and (h) of the CPPA?

A

That a vendor’s anonymization and aggregation practices meet CCPA requirements.

70
Q

What privacy checkpoints should be considered for mergers and acquisitions?

A
  1. Applicable new compliance requirements
  2. Sector-specific laws
  3. Standards
  4. Comprehensive laws and regulations
  5. Existing client agreements
  6. New resources, technologies, and processes
71
Q

What should be considered when data is transferred to a different or additional controller during a merger or acquisition?

A
  1. Data sharing must part of the due diligenece
  2. Follow the data sharing code
  3. Establish what data is transferred
  4. Identify the purpose for which data was initially obtained
  5. Establish lawful basis for which data was originally obtained
  6. Establish lawful basis for sharing data
  7. Compliance with data processing principles
  8. Document data sharing
  9. Technical advice (security risks - loss, corruption, or degradation of the data)
  10. Data subject notice

Tojasej (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions