Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cyber Security and Data Protection (DLMCSITSDP01) > Data Protection > Flashcards

Data Protection Flashcards

1
Q

What is in Article 1 of the Universal Declaration of Human Rights (United Nation, 1948)?

A

Human dignity is recognized as an absolute fundamental right.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Give an Example of a Country where privacy has been regarded as an element of liberty?

A

The United States

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Data Protection?

A

Data protection applies to any information relating to an identified or identifiable natural (living) person including names, dates of birth, photographs, video footage, email addresses, telephone numbers, and more.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does PII stands for?

A

Personal Identifiable Information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Where does the notion of data protection originates from?

A

It originates from the right to privacy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the rights of the PII principal?

A

Fair processing
Transparency
Certain rights to access or change PII

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the principles of Data Protection?

A 
PII controllers and PII processors
Consent and choice
Purpose legitimacy and specification
Collection limitation
Data minimization
Use, retention, and disclosure limitation
Accuracy and quality
Openness, transparency, and notice
Individual participation and access
Accountability
Information security
Privacy compliance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Describe PII controllers and PII processors!

A

PII controllers: determine the means and purposes of processing PII. Controllers must ensure that applicable laws are adhered to, and they are obliged to demonstrate compliance.
A PII processor: follows the instructions of a PII controller in order to process PII. Under many regulations, the relationship between a controller and processor requires a written contract.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Describe Consent and choice!

A

PII principals should have the choice of whether their data is processed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Describe Purpose legitimacy and specification!

A

All processing of PII must be compliant with applicable laws. The purpose of data processing must be communicated to the PII principals upfront, but it should be communicated again if the purpose changes over time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Describe Collection limitation!

A

The collection of PII should be limited to what is strictly necessary for the purpose defined and should be within the limitations of applicable laws.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Describe Data minimization!

A

Data minimization is related to collection limitation but goes further, looking at the processing after the initial collection of PII. It means that the processes and systems for processing PII must limit the number of stakeholders that have access to or the ability to process data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Describe Use, retention, and disclosure limitation!

A

Data must not be retained forever. This principle is about retaining data for a defined purpose, but only for as long as it is required by the organization and by law. After that period, PII should be destroyed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Describe Accuracy and quality!

A

The PII process has to be accurate and completed to a degree that it can be adequately used for the purpose defined. If PII is collected from a source that is not the PII principal, the reliability must be ensured. The accuracy and quality of the data should be checked regularly.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Describe Openness, transparency, and notice!

A

This principle means that information about the processing of PII and the purposes and means for doing so should be provided to the PII principals. In the interest of transparency, this notice should be easily readable, especially if a processing activity includes decision-making based on the PII.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Describe Individual participation and access!

A

Individuals have many rights, including the right to access their data, change inaccurate data, delete or lock the data, and easily assert these rights. In some legislations (e.g., GDPR and CCPA), they also have the right to portability, making the data available in an electronic, standardized form. Often CSV, JSON, or XML formats are used.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Describe Accountability!

A

There is a duty of due care stating that measures must be taken by an organization to ensure the protection of PII. Accountability means that an organization must be able to prove its compliance. Data privacy policies and processes are documented.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Describe Information security!

A

PII must be protected, and the CIA (confidentiality, integrity, and availability) of information has to be assured by the controller.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Describe Privacy compliance!

A

An organization must be able to demonstrate compliance by having independently verified internal controls in place. An adequate and documented risk management system is a way to show privacy compliance.

20
Q

What is the GDRP?

A

General Data Protection Regulation 616/679. As a regulation, the GDPR is directly applicable by law in the Member States and does not require a local law to be effective.

21
Q

What is the material and territorial scope of the GDPR?

A

Material: all personal and material relationships of an identified or identifiable natural person.

Territorial: all organizations established in the EU, and to organizations that track EU citizens and offer services or products within the EU.

22
Q

State the Special Categories of Data that are only allowed to be processed after consent from the individual or by a special legal requirement?

A
  • race and ethnic origin,
  • religious or philosophical beliefs,
  • political opinions,
  • trade union memberships,
  • biometric data used to identify an individual,
  • genetic data,
  • health data, and
  • data related to sexual preferences and/or sexual orientation.
23
Q

How does GDPR demonstrate accountability?

A

GDPR requires organizations to maintain a record of processing activities (ROP).

24
Q

Which criteria should be considered when carrying out the risk assessment according to GDPR Article 28?

A
  • state of the art,
  • costs of implementation,
  • nature, scope, context and purposes of processing, and
  • risk of varying likelihood and severity to the rights and freedoms of natural persons.
25
Q

When do we need DPIA?

A

We need Data Protection Impact Assessment when an activity that poses a high risk to the rights and the freedom of a person is planned.

26
Q

According to Article 6 GDPR, there are exactly six reasons that make the processing of PII lawful (PrivazyPlan, 2018a). What are they?

A
  • The PII principal (data subject) has given consent.
  • Processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract.
  • Processing is necessary for compliance with a legal obligation to which the controller is subject.

- Processing is necessary in order to protect the vital interests of the data subject or of another natural person.

  • Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

- Processing is necessary for the purposes of the legitimate interests pursued by the controller.

27
Q

Describe is the job of Data Protection Officer?

A

They monitor and audit the compliance with GDPR. They also give advice and handle the complaints of the PII principals.

28
Q

How is Privacy Compliance controlled?

A

Compliance to the GDPR is both self-controlled and controlled by supervisory authorities.

29
Q

State the rights of the Data Subjects!

A
  • transparency about the processing of data and the rights of the individual,
  • information and access to personal data,
  • rectification and erasure, and

- the right to object and automated individual decision-making.

30
Q

Data transfers between controllers and processors, and between controllers and controllers, require a written contract. What does it called?

A

Data Processing Agreement (DPA).

31
Q

Article 28 GDPR (PrivazyPlan, 2018c) requires eight topics to be added to the DPA. State them!

A
  1. The processor only agrees to process personal data if they have received the written instructions of the controller.
  2. Everyone who comes into contact with the data is sworn to confidentiality.

3. All appropriate technical and organizational measures are used to protect the security of the data.

  1. The processor will not subcontract to another processor unless instructed to do so in writing by the controller, in which case, another DPA will need to be signed with the sub-processor (pursuant to Sections 2 and 4 of Article 28).
  2. The processor will help the controller uphold their obligations under the GDPR, particularly concerning data subjects’ rights.
  3. The processor will help the controller maintain GDPR compliance with regard to Article 32 (security of processing) and Article 36 (consulting with the data protection authority before undertaking high-risk processing).
  4. The processor agrees to delete all personal data upon the termination of services or return the data to the controller.
  5. The processor must allow the controller to conduct an audit and will provide whatever information necessary to prove compliance.
32
Q

What safeguards needs to be in place in case of processing of data outside the EU?

A
  • Adequacy decisions: The EU Commission decides that the level of data protection in a third country is at a level that is acceptable to the EU. Current big economies that have obtained an adequacy decision are Argentina, Japan, Canada (private sector), and the United States (privacy shield).
  • EU model clauses: The model clauses or standard contractual clauses issued by the EU. If a processor or controller outside the EU signs and obeys them, the data can be transferred. This is the most common way to safeguard data transfers to third countries.
  • Binding corporate rules: An enterprise can obey binding corporate rules that have been approved by the national authorities of the country where its EU headquarters are based. If those are approved, data can flow inside this enterprise. Binding corporate rules have no impact on relationships outside of that enterprise.
33
Q

How a Data Breaches should be handled.

A

Whenever a data breach occurs, the organization has 72 hours from the time that the breach was discovered to inform the PII principals. If the risks to the rights and freedoms of the individuals is high, the authorities must also be informed about the breach.

34
Q

Give examples of privacy regulations in the United States!

A
  • CCPA: Californian Consumer Privacy Act.

- HIPAA: Health Insurance Portability and Accountability Act.

35
Q

Who dos the CCPA protect?

A

Not only consumers but also all residents in California.

36
Q

How can a company be under the scope of the CCPA.

A

To be under the scope of the CCPA, an organization must meet at least one of the following criteria:

  • Annual gross revenue of $25 million
  • Buys, receives, sells, or shares the personal information of 50,000 or more consumers, households, or devices
  • At least 50 percent of annual revenue from selling consumers’ personal information (California Legislative Information, 2018)
37
Q

What are the rights of the consumers (PII) under the CCPA?

A

know what PII is being collected about them.

access their PII in a readily useable format.

know whether their personal information is being sold or shared, and if so, with whom.

opt out of the sale of their PII (opt in, in cases of minors).

equal service and price regardless of exercising individual rights.

deletion of their PII upon request.

38
Q

According to HIPAA, does the patients have the right to access their data?

A

Yes, Organizations can charge a reasonable amount to provide this information.

39
Q

Give examples of required administrative measures that HIPPA requires!

A

the implementation of risk management, or a data backup plan

40
Q

Give examples of required physical safeguards that HIPPA requires!

A

facility security plan or secure disposal of media

41
Q

Give examples of required technical safeguards that HIPPA requires!

A

authentication or emergency access procedures.

42
Q

How is Data Protection regulated in Singapore?

A

Through the Personal Data Protection Act (PDPA) from 2012. Several regulations were added in 2013 to govern the enforcement of the Act detailing special provisions regarding phone calls and exemptions therefore building a comprehensive privacy framework.

43
Q

What are the four exceptions to the scope of the PDPA?

A
  1. Any individual acting on a personal or domestic basis

2. Any employee acting in the course of his or her employment with an organization

  1. Any public agency or organization acting on behalf of a public agency in relation to the collection, use, or disclosure of the personal data
  2. Business contact information
44
Q

Which Commission has the responsibility to administer the PDPA?

A

The Personal Data Protection Commission

45
Q

What are the obligation of the Date Protection Officer according to PDPA?

A
  • ensure compliance of PDPA when developing and implementing policies and processes for handling personal data,
  • foster a data protection culture among employees and communicate personal data protection policies to stakeholders,
  • manage personal data protection related queries and complaints,
  • alert management to any risks that might arise with regard to personal data.
  • cooperate with the PDPC on data protection matters, if necessary.

Cyber Security and Data Protection (DLMCSITSDP01) (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions