Information Management from a U.S. Perspective Flashcards
18-22 questions
1
Q
Define:
information management
A
establishing, implementing and monitoring the organization’s privacy program under the direction of a senior person in the organization
2
Q
duties of a chief privacy officer
A
developing and implementing policies related to data processing and properly handling of personal information
3
Q
duties of a data protection officer
A
- ensures organization’s processing and handling of personal info is in compliance with legal privacy requirements
- cannot be directly involved with decision-making regarding data processing activities
4
Q
duties of a privacy engineer
A
works to ensure that compliance with legal requirements has occurred through the technical processes of the organization
5
Q
duties of a privacy manager
A
responsible for development, maintenance and enforcement of privacy policies and procedures within an organization
6
Q
duties of a privacy analyst
A
manages legal and operational risks related to personal information held by the organization
7
Q
what are the stages of a data life cycle?
A
- data creation
- data storage
- data sharing and usage
- data archival
- data deletion
8
Q
Define:
data inventory
A
undertake an inventory of the PI it collects, stores, uses or discloses within the organization and to outside entities
9
Q
Define:
data classification
A
- classify data according to its level of sensitivity
- defines clearance of individuals who can access or handle that data, as well as the baseline level of protection appropriate for that data
10
Q
Define:
data flow mapping
A
examine and document data flows
11
Q
top-down vs. bottom-up data flow mapping
A
- top-down: starts with record of processing activities (RoPA) which is required under GDPR
- RoPA process involves documenting the purpose for processing the PI; parties to whom any PI was disclosed; retention period for PI; and details about the safeguards in place for PI
- bottom-up: understanding data assets; data inventory and classification; delineating data processes (RoPA); documenting data lineage
12
Q
privacy program should…
A
- demonstrate effective and auditable framework to enable compliance with applicable privacy laws and regulations
- promote trust and confidence in the organization’s handling of personal data
- respond effectively to requests by consumers
- address privacy and security breaches
- continually monitor and improve the maturity of the privacy program
13
Q
privacy mission statement
A
describes core function of privacy within the org
14
Q
How to ensure appropriate metrics for privacy program framework?
A
- identifying intended audience for metrics
- defining reporting sources
- defining privacy metrics for oversight and governance
- identifying systems/application collection points
15
Q
What are the four stages of privacy operatonal life cycle?
A
- assess
- protect
- sustain
- respond
16
Q
assess
A
- document baseline of privacy program
- evaluate processors and third parties
- identify operational risks
- document the assessment
17
Q
protect
A
- review access controls and technical controls
- review incident response plan
- integrate privacy requirements into functional areas of the organization
18
Q
sustain
A
- monitor and audit compliance with privacy policies
- monitor regulatory changes
- hold employee, management and contractor trainings
19
Q
respond
A
- consumer requests
- address privacy incidents
20
Q
Define:
privacy policy
A
high-level document that helps an organization meet policy goals contained within an org’s privacy vision or mission statement
21
Q
typical components of a privacy policy
A
- purpose
- scope
- applicability
- roles and responsibilities
- compliance
- penalties and sanctions for noncompliance
22
Q
revision to privacy policy
A
- according to FTC, companies should obtain express affirmative consent before making material retroactive changes to privacy representations
- material change at a minimum includes sharing consumer information with 3Ps after committing at the time of collection not to share the data
23
Q
Define:
privacy notice
A
- external statement that provides transparency concerning the org’s privacy practices
- how it collects, uses, shares, retains and discloses PI based on org’s privacy policy
24
Q
organization can communicate privacy notice to consumer by:
A
- making notice accessible online
- making notice accessible in places of business
25
layered privacy notice approach
* **short notice**: top layer that summarizes notice’s scope and basic points about the org’s practice for personal information, collection, choice, use and disclosure
* **full notice**: comprehensive information on disclosure that articulates organization’s privacy notice in its entirety
26
# Define:
just-in-time notice
notice at or before point of info collection or before a consumer accepts a service or product
27
# Define:
privacy dashboard
offers a summary of privacy-related info in a format that is intended to be easy to access and navigate
28
# Define:
double or confirmed opt-in
consumer first indicates interest in a communication list and then confirms that interest in response to the follow-up email
29
no option to opt
* when an organization uses or collects the consumer's data because that org has been given implied authority to share PI
* e.g., a consumer who orders her product online expects her PI to be shared with the shipping company, credit card processor, etc.
30
good rule of thumb: channel for marketing should be...
chanel for exercising a user preference
31
privacy risk management
* process that identifies and assesses the risk to an org’s information assets and then implements appropriate mitigation strategies to reduce or eliminate those risks
* often includes conducting PIAs, vendor/third-party risk aseessments, data breach readiness assessments
32
# Define:
organizational code of ethics
* helps in assessing benefits and risks of processing personal data
* focuses on topics such as how to respect individuals whose PI held by org; downstream uses of personal data; consequences of utilizing analytical tools; whether to collect data that the org does not need; how should the org design practices to ensure transparency, accountability and auditability
33
# Define:
privacy risk
likelihood that individuals will experience problems resulting from data processing, and the impact of these problems should they occur
34
# Define:
privacy impact assessment
* provides analysis of how personal information is handled to ensure handling conforms to applicable legal, regulatory and policy requirements regarding privacy
* determine risks and effects of collecting, maintaining and disseminating personal info in identifiable form
* examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks
35
# Define:
privacy risk assessment
* core of PIA
* focuses on determining level of privacy risk by looking at the privacy impact and likelihood given the controls
36
precautions to consider in written contract with third-party vendor
* confidentiality provision
* no further use of shared information
* subcontractors should follow privacy and security protection terms in vendor’s K
* requirement to notify and to disclose breach
* information security provisions
* end of relationship → return of data or deletion of data at conclusion of relationship
37
standards for vendor selection
* reputation
* financial condition and insurance
* information security controls to ensure data isn’t lost or stolen (e.g., SOC 2)
* secure transfer mechanisms for data
* appropriate disposal of information → appropriate destruction of data in any format or media
* employee training and user awareness
* vendor incident response
* org should be able to audit vendor’s activities to ensure compliance with contractual obligations
38
# Define:
information security
protection of information for the purpose of preventing loss, unauthorized access, or misuse
39
What are the three key attributes of information security?
* confidentiality
* integrity
* availability
40
# Define:
confidentiality
access to data is limited to authorized parties
41
# Define:
integrity
assurance that the data is authentic and complete
42
# Define:
availability
knowledge that the data is accessible, as needed, by those who are authorized to use it
43
# Define:
security controls
mechanisms put in place to prevent, detect or correct a security incident
44
What are the three types of security controls?
* **physical** controls such as locks, security cameras and fences
* **administrative** controls such as incident response procedures and training
* **technical** controls such as firewalls, antivirus software, and access logs
45
# Define:
NIST Cybersecurity Framework
voluntary tool for orgs to better manage and reduce cybersecurity risks with following core elements:
* **identify**→ looks at people, systems, data and capabilities to understand what a potential risk could be
* **protect** → focuses on safeguards for risks that an organization wants to mitigate
* **detect** → activities that identify a cybersecurity incident
* **respond** → what activities an org takes when there is an incident
* **recover** → plans to restore business operations from a cybersecurity incident
46
# Define:
data breach readiness assessment
| (include factors)
examines level of risk of a data breach coupled with the likelihood and severity of a personal data breach by looking at following factors:
* types and nature of personal data involved, particularly sensitive personal information
* whether appropriate technical safeguards have been applied
* whether the data subject will be directly or indirectly affected
* possibility that personal data can be maliciously used
* possibility of substantial damage on a physical level
47
What are mechanisms for cross-border data flows?
* domestic approaches (or unilateral mechanism) → more than ½ of countries with safeguards for cross-border data flows employ pre-authorization safeguards
* multilateral arrangements such as OECD Privacy Guidelines; APEC Cross-Border Privacy Rules; Council of Europe Convention 108 and 108+
* trade agreements which may contain provisions
* standards and technology-driven initiatives such as ISO standards and privacy-enhancing technologies (PETs)
48
When does GDPR apply?
* when EU-based establishments process personal data of any subjects *and*
* when establishment based outside of the EU monitors behavior of or targets goods or services to data subjects in the EU
49
# Define:
personal data (under GDPR)
any data related to an identified or identifiable natural person (can be identified directly or indirectly)
50
# Define:
sensitive personal data (under GDPR)
special category of personal data that gets additional protections under GDPR and requires the business to obtain “explicit consent” from the person to process the data for a specified purpose
51
Examples of sensitive personal data under GDPR?
* race or ethnic origin
* political opinions
* religious or philosophical beliefs
* trade union membership
* genetic data
* biometric data
* health data, sex life
* sexual orientation
52
# Define:
data subject
| under GDPR
any natural person whose data is being collected, stored or processed
53
controller
| under GDPR
individual or entity that determines the purposes and the means of the processing of personal data
54
What are obligations of a controller?
* implement data protection by default and by design
* provide instructions to processors
* ensure data security
* report data breaches
* cooperate with DPAs
* appoint a DPO for the business
* identify legal basis for processing
* maintain data processing records
* conduct data protection impact assessments
55
# Define
processor
| under GDPR
an individual or entity that processes personal data on behalf of the controller
56
What are obligations of a processor?
* confidentiality
* record of processing activities
* data security
* data breach reporting
* cooperation with DPAs
57
# Define
consent
| under GDPR
freely given, specific, informed and an unambiguous indication of the data subject’s wishes
58
For consent to processing of data to be informed, it must contain:
| under GDPR
1. controller’s identity
2. purpose of processing for which consent is sought
3. types of data that will be collected
4. information about the right to withdraw consent
5. information about automated processing
6. risks of transfers outside the EU
59
# Define:
data protection authority
| under GDPR
independent public authorities that investigate and enforce data protection laws at a national level
60
# Define:
data protection officer
| under GDPR
primary point of contact on data protection issues within a business that is based in the EU
61
What are the seven key principles of GDPR?
1. lawfulness, fairness and transparency
2. purpose limitation
3. data minimization
4. accuracy
5. storage limitation
6. integrity and confidentiality
7. accountability
62
# Define:
lawfulness, fairness and transparency
| under GDPR
* companies should have a legal basis for processing personal data
* data subjects should be made aware of the rules and safeguards as well as the risks associated with their data
63
What is considered "transparent" under GDPR?
communications must be concise, easily accessible and written using clear and plain language that is easy to understand
64
# Define:
purpose limitation
| under GDPR
* personal data must be collected for specified, explicit and legitimate purposes
* personal data shouldn’t be further processed in a manner that is incompatible with the original purpose for which it was collected
65
# Define:
data minimization
| under GDPR
* processing of personal data must be adequate, relevant and limited to what is necessary considering the purposes of processing
* requires deletion or anonymization of personal data that is no longer necessary and any data retention period be limited to a strict minimum
66
# Define:
accuracy
| under GDPR
personal data must be accurate and, where necessary, kept up to date
67
# Define:
storage limitation
| under GDPR
personal data must be kept for no longer than is necessary for the purposes of processing
68
# Define:
integrity and confidentiality
| under GDPR
personal data must be processed in a way that ensures a level of security appropriate to the risk of processing the personal data through appropriate technical and organizational measures
69
# Define:
accountability
| under GDPR
controller is responsible for and must be able to demonstrate compliance with the other six principles
70
What are the eight primary data subject rights?
| under GDPR
1. right to be informed of transparent communication and information
2. right of access
3. right to rectification
4. right to erase / right to be forgotten
5. right to restriction of processing
6. right to data portability
7. right to object
8. right not to be subject to automated decision-making
71
How soon must controllers respond to rights requests?
| under GDPR
within one month of request (or, where necessary, within three months) in writing or, if requested, orally
72
# Define:
right to be informed of transparent communication and information
| under GDPR
privacy notice to provide info
73
# Define:
right of access
| under GDPR
right to obtain following from controllers:
* confirmation as to whether a controller is processing the data subject’s personal data
* a copy of the personal data
* other information that should already be provided in a privacy notice
74
# Define:
subject access request
| under GDPR
when data subjects exercise their right of access
75
# Define:
right to rectification
| under GDPR
allows data subjects to require controllers to confirm the accuracy of their personal data
76
# Define:
right to erase ("right to be forgotten")
| under GDPR
right to have personal data erased in circumstances where:
* personal data no longer necessary for purposes collected or otherwise processed
* data subject withdraws consent on which the processing is based and there is no other legal ground for processing
* data subject objects to processing based on legitimate interests and no overriding legitimate grounds for the processing
* personal data was unlawfully processed
* personal data has to be erased for compliance with a legal obligation
* personal data has been collected to offer info society services to children
77
What does a controller do if a data subject requests their personal data to be deleted?
| under GDPR
controller must delete personal data and if has made public data publicly available online, must use reasonable measures to inform other controllers processing the personal data to erase
78
# Define:
right to restriction of processing
| under GDPR
can limit the way their personal data is processed
79
When does the right to restriction of processing apply?
* accuracy of personal data is contested and controller is verifying accuracy
* processing is unlawful and data subject prefers to have the use of their personal data restricted rather than having it erased
* controller no longer needs the personal data but the data subject requires it for the establishment, exercise or defense of legal claims
* data subject has objected to processing pursuant to the GDPR and controller is verifying whether its legitimate grounds override those of the data subject
80
# Define:
right to data portability
| under GDPR
data subjects can port data to themselves or to another controller
81
When does the right to data portability apply?
| under GDPR
only applies to:
1. personal data provided by data subject
2. where processing based on consent or the performance of a contract
3. when processing carried out by automated means
82
# Define:
right to object
| under GDPR
data subjects can require controllers to stop processing their personal data
83
When can a data subject exercise their right to object?
| under GDPR
if controller is processing their personal data for:
* direct marketing purposes
* on legal basis of legitimate interests
* on legal basis of task carried out in public interest
* on legal basis of exercise of official authority
84
# Define:
right not to be subject to automated decision-making
| under GDPR
general prohibition on fully automated decision-making, including profiling, that has a legal or similarly significant effect
85
When can a controller carry out automated decision-making based on processing of personal data?
when:
1. necessary for performance of a K between data subject and controller
2. authorized by law *or*
3. based on data subject’s explicit consent
86
# Define:
data breach
| under GDPR
breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted stored or otherwise processed
87
When does a controller have to report a data breach to a DPA?
| under GDPR
to relevant DPA within 72 hours of becoming aware where feasible UNLESS unlikely to result in risk to individuals' rights and freedoms
88
# Define
aware
| under GDPR related to breach
have reasonably degree of certainty that a security incident has compromised personal data
89
When does a controller have to report a data breach to data subjects?
| under GDPR
if data breach occurs that is likely to result in high risk to individuals’ rights and freedoms, then without undue delay
90
What should be contained in the controller's notice to data subjects of a data breach?
| under GDPR
notice must be in clear and plain language and must include name and contact of the DPO, likely consequences of the data breach, and any measures taken by controller to mitigate the risk
91
How can a data subject take action?
| under GDPR
* initiate administrative complaint
* go to national court (if unsatisfied with decision of DPA or DPA doesn't inform give update on complaint within three months)
* seek judicial remedy
92
How is the complaint process initiated?
| under GDPR
can be initiated by data subject or by DPA
93
What does a DPA do with a complaint?
| under GDPR
1. assessment to determine lead DPA (if more than one DPA has complaint)
2. assess to determine whether to impose adminisrtative fine
94
liability of processor vs. controller
| under GDPR
each is liable for entire damage if both involved in same processing and once data subjects compensated, then they can get comp from each other
95
higher-level fines
| under GDPR
greater of 20 mil Euros or 4% of global annual revenues
96
lower-level fines
| under GDPR
greater of 10 mil Euros or 2% of global annual revenues
97
What do higher-level fines cover?
| under GDPR
infringements related to basic principles of processing, rights of data subject and transfers of personal data to a recipient outside EU
98
# Define:
European Economic Area
EU and Norway, Liechtenstein and Iceland
99
What is required for data transfers from the EEA to non-EEA countries?
prohibited unless can rely upon adequacy decision, appropriate safeguard or a derogation
100
# Define:
adequate transfer
| international data transfers
data transfer to a country that has adopted protections that the EU law deems “adequate” (essentially equivalent to those found in the GDPR)
101
# Define:
appopriate safeguard
| international data transfers
* legally binding and enforceable instrument between public authorities or bodies
* binding corporate rules
* standard contractual clauses
* standard data protection clauses adopted by European Commission
* standard data protection clauses adopted by a DPA and approved by European Commission
* approved code of conduct, together with binding and enforceable commitments of the non-EEA controller or processor
* approved certification mechanism together with binding and enforceable commitments of non-EEA controller or processor
* contractual clauses authorized by DPA or of the controller/processor transferring the data outside the EEA
* administrative arrangements between public authorities authorized by the DPA in the country from which the transfer is made
102
# Define:
binding corporate rules
| international data transfers
provide that a multinational company can transfer data between countries, including among affiliated entities, after certification of its practices by a DPA
103
# Define:
standard contractual clause
| international data transfers
company contractually promises to comply with EU law and to submit to supervision of a DPA
104
# define
derogations
| international data transfers
allow for a transfer if the data subject has provided explicit consent to the transfer or if the transfer is necessary for one of following:
* performance of K between data subject and controller and transfer is occasional
* performance or conclusion of a K concluded in interest of data subject between controller and 3P and transfer is occasional
* important reasons of public interest
* establishment, exercise or defense of legal claims and the transfer is occasional
* protection of vital interests of an individual incapable of giving consent
105
# Define:
last-resort derogation
| international data transfers
transfer can take place if necessary for purposes of compelling legitimate interest and meets all of specified requirements under the GDPR
106
history of data transfers from EU to U.S.
1. Safe Harbor program under EU Data Protection Directive until 2015
2. Schrems I case (2015)
3. Privacy Shield (2016)
4. Schrems II case (2020)
5. Data Privacy Framework finalized in July 2023
107
Schrems I case (2015)
CJEU struck down Safe Harbor program
108
Schrems II case (2020)
CJEU struck down Privacy Shield and raised concerns about perceived lack of legal protection from U.S. government surveillance for EU data being transferred to Facebook
109
key points of EU-U.S. Data Privacy Framework
U.S. agreed to ensure that surveillance activities would comply with the “necessity and proportionality” standard and to establish an independent data protection review court to provide European citizens the ability to complain when they believe their personal data has been collected inappropriately by U.S. intelligence agencies/U.S. designed EU and member states as qualifying states
110
recent developments in global data flows
* APEC issued declaration concerning an international approach to allow trade between participating countries while providing assurances how data will be handled
* **Global Cross-Border Privacy Rules Forum**: establishment of international certification system based on existing APEC Cross-Border Privacy Rules and Privacy Recognition for Processors (PRP) Systems announced in 2022
* OECD adopted a declaration on common principles for government access, both for law enforcement and national security purposes, to personal data held by private companies
