Information Management from a U.S. Perspective Flashcards
What is no consumer choice or no option?
When companies use consumer data for practices that are consistent with the context of the transaction, consistent with the company’s relationship with the consumer, or as required or specifically authorized by law.
What are some management challenges of user preferences?
- The scope of the opt-out or other user preference can vary.
- The mechanism for providing an opt-out or other user preference can vary.
3, Linking of a user’s interactions. - The time period for implementing user preferences.
- Third party vendors often process PI on behalf of the company.
What precautions should be included in vendor contracts?
- Confidentiality provision
- No further use of shared information.
- Use of subcontractors.
- Requirement to notify and to disclose breach
- Information security provisions
When do multiple Privacy Policies make sense?
When a company that has well-defined divisions of lines of business, especially if each division uses customer data in very different ways, does not typically, share PI with other divisions and is perceived in the marketplace as a different business.
What does Determining Data Accountability involve?
The responsibility to assure compliance with privacy laws and policies.
What does Data Inventory involve?
An inventory of the PI (employee and customer) that the organization collects, stores, uses, or discloses. It should document data location and flow as well as evaluate how, when, and with whom the organization shares such information - and the means for data transfer used.
What laws give consumers the right to access the PI held about them?
- FCRA
- HIPAA
- Statements on fair information practices - OECD Guidelines, APEC Principles
What does Data Classification involve?
Classifying data according to its level of sensitivity. It should define the clearance of individuals who can access or handle the data, as well as the baseline level of protection that is appropriate for that data.
What does Documenting Data Flows involve?
The mapping and documenting of the systems, applications, and processes handling data.
What do the Reputational Risks stem from?
Legal enforcement and if they announce privacy policies but do not carry them out. .
What do the Investment Risks stem from?
The ability to receive an appropriate return on it investments in information, information technology, etc.
What are the 4 basic steps for Information Management?
- Discover
- Build
- Communicate
- Evolve
What should practices and controls that organizations use for managing PI address?
- Data Inventory
- Data Classification
- Documenting Data Flows
- Determining Data Accountability
What is an opt-in?
One of two central concepts of choice. It means an individual makes an active affirmative indication of choice; i.e., checking a box signaling a desire to share his or her information with third parties.
What is an opt-out?
One of two central concepts of choice. It means an individual’s lack of action implies that a choice has been made; i.e., unless an individual checks or unchecks a box, their information will be shared with third parties.
