Foundational principles of Privacy in Technology

Question 1

Data Lifecycle Components (5)

Answer 1

Collection
Use
Disclosure
Retention
Destruction

Question 2

The data lifecycle is shaped by…

Answer 2

privacy objectives and business practices

Question 3

First-party data

Answer 3

Individual provides their PI directly to collector

Question 4

Individual’s data stream behavior is observed through their activities (searches, web visits, etc.)

Answer 4

Surveillance data collection

Question 5

Repurposing/Secondary Use

Answer 5

Data used for purpose other than that for which it was previously collected

Question 6

Third-party collection

Answer 6

Previously collected information is transferred to a third party

Question 7

Active collection

Answer 7

Data subject is aware of collection and takes action to enable collection

Question 8

Passive collection

Answer 8

Occurs without action of the participant and isn’t always obvious

Question 9

Explicit consent

Answer 9

Requires user to take an action

Question 10

Implied consent

Answer 10

Does not require a user to take an action

Question 11

True or False: Implied consent is valid

Answer 11

Mostly true: It is valid in some territories

Question 12

Is implied consent valid in the EU?

Answer 12

No

Question 13

Explicit or Implied Consent: Clicking a button that acknowledges a privacy notice has been received.

Answer 13

Explicit consent

Question 14

Explicit or Implied Consent: Users must choose to opt in or out of collection of information before using a website

Answer 14

Explicit

Question 15

Privacy notice (aka privacy statement)

Answer 15

Statement made to data subjects that describes how PI is collected, used, retained, and disclosed.

Question 16

Repurposing or disclosing data in unstated ways causes…

Answer 16

Harms and may be illegal

Question 17

What should happen before data is repurposed or disclosed in new contexts?

Answer 17

It should be assessed for risks.
Update notices
Request consent

Question 18

What determines how long data can be retained?

Answer 18

Legal and regulatory requirements

Applicable standards

Question 19

What should be assessed before data is moved offsite?

Answer 19

Risks and benefits

Security of transfer mechanism

Question 20

Quality requirements that should be associated with data (4)

Answer 20

Quality
Relevance
Accuracy
Completeness

Question 21

What must DR and BCP plans highlight?

Answer 21

Business sensitive data that must be retained

Question 22

What is a retention period attribute used for?

Answer 22

System reads attribute and deletes file when period has passed.

Question 23

A data lifecycle describes…

Answer 23

How data flows through an organization

Question 24

PbD

Answer 24

Privacy by Design

Question 25

PbD is based on...

Answer 25

Proactively into privacy into all levels of operations.

Question 26

What is not a tradeoff or something to add after it has been built?

Answer 26

Privacy by Design

Question 27

What integrates the promition of privacy in system design?

Answer 27

Privacy by Design

Question 28

Who conceptualized Privacy by Design?

Answer 28

Anne Cavoukian

Question 29

Meaning: Proactive, not reactive; Preventative, not remedial

Answer 29

Make privacy a consideration in the design phase instead of reacting to harms.

Question 30

Meaning: Privacy as the Default Setting

Answer 30

The default of a system should preserve privacy.

Question 31

Privacy as the Default example

Answer 31

Opt-in instead of Opt-out

Question 32

Contextual integrity

Answer 32

Personal information handled based on norms (situational expectations)

Question 33

Meaning: Privacy Embedded into Design

Answer 33

Privacy is integral to design. System can't be used without privacy features.

Question 34

Meaning: Full functionality - Positive sum, not zero sum

Answer 34

Getting full performance while protecting privacy. | Privacy is not a trade-off

Question 35

Meaning: End-to-end Security-Full lifecycle protection

Answer 35

Assess privacy risks in each stage of the information lifecycle.

Question 36

Meaning: Visibility and Transparency - Keep it open

Answer 36

Providing notice. Gives people a choice.

Question 37

Meaning: Respect for user privacy; keep it user centric

Answer 37

Designing for privacy and respecting Individuals needs and risks

Question 38

IAPP Risk calculation

Answer 38

Potential Threat + Impact of threat + Likelihood

Question 39

Risk management options (4)

Answer 39

Accept Transfer Mitigate Avoid

Question 40

FIPPs

Answer 40

Privacy values that work alongside compliance models | High level compared to legal compliance

Question 41

Which privacy model is a high-level privacy strategy?

Answer 41

FIPPs

Question 42

Contextual integrity

Answer 42

Using PI in alignment with norms that apply to a particular context

Question 43

Actors

Answer 43

Senders and receivers of PI

Question 44

Nissenbaum's term: "Attributes"

Answer 44

Type of information being shared

Question 45

Transmission principles

Answer 45

Govern the flow of information

Question 46

What happens when disruptions from informational norms occur?

Answer 46

Privacy problems

Question 47

What principle applies to identifying norms and designing for vulnerabilities?

Answer 47

Nissenbaum's contextual privacy

Question 48

Ryan Calo

Answer 48

Law professor (Cyber law, privacy, and robotics)

Question 49

Calo's harms dimensions (2)

Answer 49

Objective | Subjective

Question 50

Attributes of objective harms (4)

Answer 50

Privacy violation Direct harm is known Forced or unanticipated use of PI Measurable and Observable

Question 51

Attributes of subjective harms

Answer 51

Expected or perceived harm | May not be observable or measurable

Question 52

Subjective harms can cause...(3)

Answer 52

Fear Anxiety Embarrassment

Question 53

Subjective vs. Objective harms

Answer 53

Subjective is threat. Objective is actual experience. | Feelings vs. consequences

Question 54

Why type of harm affects psychology and behavior?

Answer 54

Subjective

Question 55

Which harm leads to lost business, lost trust, social detriment?

Answer 55

Objective

Question 56

Freedom is impacted by...

Answer 56

privacy harms

Question 57

What can be used to build and retain trust?

Answer 57

Privacy notices and controls

Question 58

What does the NIST Privacy Framework do? (2)

Answer 58

Assist orgs in communicating and organizing privacy risk. | Guidance to build and evaluate privacy governance program

Question 59

NICE Framework

Answer 59

Categorizes and describes cybersecurity work using common terminology

Question 60

FAIR Model

Answer 60

Estimate risk Build range of potential risk Breaks down risk by its constituent parts

Question 61

FAIR risk parts

Answer 61

Frequency and magnitude, and impact

Question 62

What asks how often violation will occur and what time period?

Answer 62

FAIR model

Question 63

Value-sensitive design

Answer 63

Design approach that accounts for moral and ethical values

Question 64

Goal of value sensitive design

Answer 64

Stakeholders see their values reflected in the final design

Question 65

Direct stakeholders

Answer 65

Directly interact with the system

Question 66

Indirect stakeholders

Answer 66

Affected by the system but don't interact with it.

Question 67

Value-sensitive design investigations (3)

Answer 67

Conceptual Empirical Technical

Question 68

Direct and indirect stakeholder analysis

Answer 68

Stakeholders and the benefits, harms, or tesions that affect them are identified

Question 69

Design thinking process (5)

Answer 69

``` Empathize Define Ideate Prototype Test ```

Question 70

Which design method accounts for ethical values?

Answer 70

Value-sensitive design

Question 71

What type of approach is the Design Thinking Process?

Answer 71

Iterative

Question 72

What is the result of combining value-sensitive design with Design thinking?

Answer 72

Integration of values with current system design methodologies.