Introduction to US Privacy Environment (35 questions) Flashcards

Question

self regulatory authority

Answer 1

can bring enforcement actions ex - payment card industry- data security standard - digital advertising alliance - network advertising initiative - direct marketing association

Answer 2

most prominent self regulatory group imposes significant obligations which are enforced by individual card brands (AMEX, Discover, Visa, Mastercard) through their own program for compliance and enforcement rules (drafted by PCI DSS counsel) - firewall - no vendor supplied defaults for passwords - protection of cardholder data - encrypt cardholder data on public networks - anti-virus software - restrict access to cardholder data - track access - test systems - maintain policy - hire qualified security assessor to assess and detect security violations

Answer 3

most prominent self-regulatory group in advertising developed by advertising and marketing trade groups goal: provide consumers ability to opt-out of online and interest based ads enforcement: council of better business bureaus and digital & marketing association

Answer 4

exclusion from Visa, Mastercard, or other payment card systems + penalties of 5,000-100,000/ month of noncompliance

Answer 5

privacy seal programs - programs that require companies to abide by set of principles and operating procedures in exchange for the right to display a seal or logo indicating certification with those principals goal- increase consumer confidence and trust ex. better business bureau

Answer 6

plaintiff vs defendant basis- civil violation of statute or civil wrong arising under common law (tort or contract) relief- monetary damages, injunction, specific performance, declaratory judgment standard of liability- P prove by preponderance of evidence (more likely than not) same procedural protections for both parties

Answer 7

department of justice (federal) or state prosecutor/attorney general vs defendant basis- violation of criminal statute relief- criminal sentence (fine or prison) standard of liability- government proves guilty beyond a reasonable doubt additional procedural protections for defendant (ex. presumption of innocence, 6th amendment right to counsel, right to speedy trial)

Answer 8

breach of contract- one party fails to perform any of its contractual obligations at time performance is due remedies- monetary damages measured by - expectation interest (put plaintiff in position he would be in if contract was performed) - reliance interest (put plaintiff in position he would be in if contract not made) - restitution interest (prevent party from unjust enrichment as result of breach) specific performance- ordered to comply with terms of contract/ available when no other remedy will adequately compensate

Answer 9

types - intentional (party knows or should know would cause harm to another) - negligent (party fails to observe standard of care) - strict liability (engage in certain prohibited conduct)

Answer 10

person intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns must be highly offensive to reasonable person - substantial burden to one's existence not just annoyance

Answer 11

person uses another name or likeness for their own benefit without permission

Answer 12

person publicizes matters concerning another private life that are not of legitimate public concern must be highly offensive to reasonable person

Answer 13

person publicized matter concerning another that places the other before the public in false light must be highly offensive to reasonable person person must have had knowledge or acted in reckless disregard to falsity

Answer 14

administrative procedures act (APA) - provides set of procedural rules that govern actions (similar to FCRP) - statutes can mandate specific enforcement producers different from those in APA (ex. FTC act) procedure 1. commission issues complaint (can settle through consent decree which must be imposed for up two 20 years) 2. administrative trial proceeds before ALJ - violation found- ALJ enjoined company from continuing practices and order becomes final 60 days after served on company - FTC can seek civil penalties (43,280/violation) if order is ignored by company 3. decision in appealable (1st to 5 commissioners then to federal district court)

Answer 15

network that connects privacy enforcement authority from around the world to promote and support cooperations in cross-border enforcement of laws protecting privacy members: FTC, FCC, and California attorney general

Answer 16

1. **exchanging** info 2. encouraging **training** opportunities 3. promoting **dialogue** 4. creating processes and **mechanisms** that can be utilized 5. undertaking and supporting specific **activities** Mechanisms Activities Training Exchanging Dialogue

Answer 17

personal information (personally identifiable information) not non personal information generally doesn't include IP addresses (unless FTC- says IP addresses are personal info in connection with breach of healthcare info)

Answer 18

one who can be ascertained with pertaining SSN, passport number, names likely to be regulated

Answer 19

one that can be indirectly identified through combination of various factors ex. know person lives in specific city less likely to be regulated

Answer 20

subject to greater regulation for collection, use and disclosure what is considered as sensitive varies from jurisdiction to jurisdiction depending on particular regulations generally includes financial info, health info, drivers license numbers, SSN

Answer 21

at the center of US privacy regulation not generally accessible or easily accessed due to law or custom ex. medical records, financial info, adoption records

Answer 22

info collected and maintained by gov entity and available to public law in jurisdiction determines if considered protected or not (private or not) ex. court filings, real estate records

Answer 23

generally not protected info generally available to wide range of persons ex. social media, search engines

Answer 24

encryption (put it in unrecognizable form) anonymization (strip data of identifying info) pseudonymization (associated data with pseudonym so no longer attributed to specific person without additional info) ex. user 1

Answer 25

individual whose personal information is being processed ex. patient, employee, customer

Answer 26

organization/individual that decided how personal information is being utilized and processed subject to heaviest amount of regulation by privacy and data security laws

Answer 27

organization/ individual that processes data on behalf of data controller ( collection, storage, use, disclosure, transmission destruction) what it can do is limited by data controller organization/ individual may be both data processor and data controller includes 3rd party data controller contacts

Answer 28

uniform regulation over entire economy DPA (data protection agency)- responsible for oversight of enforcement issues: 1. cost outweighs benefits 2. one law no matter how unique situation is 3. no innovation 4. officials granted varying degrees of enforcement power from country to country 5. countries choose to allocate varying levels of resources to enforcement of data laws pros: 1. remedy past injustices 2. ensure consistency 3. promote electronic commerce

Answer 29

enacts laws that address a particular industry sector multiple enforcement agencies pros: 1. different parts of economy face different challenges for privacy and security 2. cost savings 3. little regulatory burden for organizations outside regulated sectors cons: 1. lack of single DPA to oversee issues 2. gaps (inadequate) and overlaps (overly burdensome) in coverage 3. government agencies may develop different policies

Answer 30

self regulation + comprehensive or sectoral model emphasizes industry development of enforceable codes or standards for privacy and data protection against legal requirements by government overseen by both privacy industry + government ex. COPP- compliance with codes are sufficient for compliance with statute

Answer 31

emphasizes creation of codes of practice for protection of PI by company, industry or independent body no generally applicable data protection law ex. PCI DSS- enhances cardholder data security and facilitates the broad adoption of consistent data security measures globally

Answer 32

means for organizing multiple individual rights and organizational responsibilities that exist with respect to PI covers both 1. individual rights related to PI + 2. how organizations manage data they collect

Answer 33

notice- description of org info management practices, for consumer education and accountability of corporation consent and choice- ability to specific whether PI will be collected and how it will be used or disclosed (express or implied) - opt in= affirmative indication (no failure to answer) - opt-out - can be implied through failure to object to use or disclosure access- ability to view PI held by org - generally require access and correction when info used for substantive decision making (ex. credit report)

Answer 34

controls- info security (reasonable admin, tech, and physical safeguards to protect PI) and information quality ( maintain accurate, complete and relevant PI) information life cycle - collection (only for purpose identified) - use and retention (only for purpose identified + consent + how long necessary to fulfill purpose) -disclosure (only for purpose identified + consent)

Answer 35

1. privacy fundamentalists 2. privacy pragmatist 3. privacy unconcerned

Answer 36

consumer that is - generally distrustful of organizations that ask for their personal info - favors stricter privacy regulation 25% of people in US

Answer 37

consumer that weights benefits of various consumer opportunities and services vs. protections necessary to make sure PI is not abused majority of public

Answer 38

consumers that are - generally trustful of organizations collecting their personal info - willing to sacrifice privacy in favor of commercial or public benefits

Answer 39

process for 1. creating data inventory 2. conducting data flow analysis 3. classifying categories of data

Answer 40

identifies personal data as it moves across various systems including includes both customer and employee data records legally required for some organizations

Answer 41

1. data location - physical location + general understanding about where data is stored - electronic data= file saved on + server stored on 2. data residency - where servers storing data are physically located - dictates what laws apply to how data is processed 3.data access - identify who has access to data being processed - identify how and when such info is shared - looks at both internal access and 3rd party external access

Answer 42

examination and documentation of data flows through organization identifies - purpose data is used for - types of data processed - risks and controls at each step - maintenance plan (for compliance) increases confidence in regulatory compliance and becomes a record to reference for customers and employees

Answer 43

classifying data according to its level of sensitivity which in turn defines - level of clearance individual who can access and handle data - baseline level of protection appropriate for data categories are generally tailored to organization but commonly include - confidential info - proprietary info - sensitive info - restricted info - public info

Answer 44

1. balance risks 2. understand organizational goals 3. develop policies 4. privacy operational life cycle

Answer 45

1. legal risk (regulatory action and litigation that may result from failing to comply with laws and regulations) 2. reputational risk (trust consumers place in organization + organizations reputation may affect consumer behavior ) 3. organizational risk (balance between compliance with privacy regulations and achieving organizational goals) 4. investment risk (balance what investment in information management and technology are worth the coals)

Answer 46

continuous refinement of privacy program should do following 1. assess (identify risks ) 2. protect (develop policies and practices) 3. sustain (communicate, monitor, and audit) 4. respond (respond to privacy incidents and handle complaints)

Answer 47

user consent + user access + notice

Answer 48

express form of consent requires some affirmative act by consumer before consent will be deemed adequate scope determined by organization legally required for COPPA- express consent of parent required before personal info of child is connected

Answer 49

consumer initially expresses interest + asked second time to confirm interest

Answer 50

passive form of consent allows collection and use of data unless user expressly states desire not to have info collected may require 2nd opportunity to opt-out even after initial consent scope should be more broad than narrow (ex. comply across all communications regardless of media used to communicate request) legally required for VPPA- required in certain cases before movie rental data is provided to 3rd parties

Answer 51

where authority to collect and utilize data is implied from situations "commonly accepted categories of commercial data practices" includes - product fulfillment (implicit consent to share address with delivery company + credit card company processing financial portions of transaction) - fraud prevention - internal operations - legal compliance and public purpose - 1st party marketing

Answer 52

mechanism for obtaining consent recommendation- provide consumers choice in same manner in which communicated with consumer

Answer 53

2 components 1. actual access to information collected 2. ability to correct that information that is inaccurate or incomplete

Answer 54

concerned with personal information policies behind handling info - identify users and users of information - seeks agreement to use information - limits collection - provide avenues for complaints - allow access to info to maintain accuracy and completeness

Answer 55

concerned with confidential information protection of data from unauthorized access - protection system and data from threats - malicious code detection and prevention - configurations and patch management - intrusion detection and mitigation

Answer 56

confidentiality - access limited to authorized persons only - accomplished through access control list, encryption, file permissions integrity - info kept in authentic, accurate, and complete form availability - kept in way that those with authorization can adequately access it

Answer 57

measure that is modifying risk includes processes, policies, devices, practice or other actions.

Answer 58

prevention - prevent security event form occurring or otherwise prevent errors or other negative consequences detective - identify security incident while it is in progress ex. active monitoring of closed- circuit tvs corrective - fix or limit damage caused by security incident ex. data loss prevention systems that remotely wipe employees hard drive when laptop is lost

Answer 59

physical - mechanisms designed to limit or monitor physical access to an environment or object ex. locks and security cameras administrative - internal procedures and mechanisms put in place to limit and monitor access to information + training of employees to follow those internal procedures technical - applications of technology that help protect information against unauthorized access categories - obfuscation (ex. randomization or hashing) - data minimization (ex. data segregation) - security (ex. access controls and antivirus software) - privacy engineering (ex. anonymous digital credentials)

Answer 60

employees should receive awareness training and regular update on organizational policies and procedures relevant to job function benefits: lowers cost of responding to data breaches

Answer 61

HIPPA privacy and security rules - must train all members of workforce within reasonable time on policies and procedures with respect to protected health info as necessary for them to carry out functions within entity GLBA safeguard rule - financial institution must train staff to prepare and implement info security program - specialized training required where appropriate FTC red flags rule - must establish identity theft program and training is necessary to effectively implement program Massachusetts data security law - anyone that owns or licensed PI about MA resident must have comprehensive security program in place that includes ongoing employee training and maintenance of system

Answer 62

requires implementation of security awareness program to make all personnel aware of importance of cardholder data security

Answer 63

org must hold themselves accountable for maintaining adequate privacy protections internal association of privacy professionals defines accountability as implementation of appropriate tech and organizational measures to ensure and be able to demonstrate that handling of personal data is performed in accordance with relevant law requires significant amount of documentation to demonstrate compliance (each compliance procedure is unique to organization)

Answer 64

written document setting forth how company collects, stores, and uses PI it gathers purposes: - inform employees how info should be stored, accessed, and utilized - set limits on how info may be used - inform consumers about how data will be used may be required by law to implement (ex. GLBA for financial institutions, and CalOPPA for companies collecting personally identifiable info)

Answer 65

organization as data controller always remains liable for data misuse by vendors ways to oversee 3rd party data vendors 1. vet vendor (look at reputation, finances, and security controls) and 2. vendor contract (usually required by law)

Answer 66

1. confidentiality- not share data with other parties 2. security protections- specific controls must be put in place (ex. employee training, encryption, and reporting of breaches) 3. audit rights- right to audit 3rd party security practices to ensure compliance 4. no further use- no use for purposes other than specified 5. subcontractor use- not appropriate to use at all or if used set forth requirements for subcontractor 6. information sharing- what may be shared between principal and vendor and subcontractors 7. breach notice- vendor required to provide immediate notification of breach 8. consumer consent- vendor obligated to abide by consumer preferences and consents provided to principal organization 9. end of relationship- what happens to data (delete or return) 10. vendor incidents- protocol that should be followed when vendor incident and steps for response

Answer 67

provision of software and other info tech services over the internet forms 1. software as a service (SaaS) 2. platform as a service (PaaS) 3. infrastructure as a service (IaaS) there is public cloud (servers assessable by 3rd party) and private (only allow access to one org)

Answer 68

where servers that are storing data are physically located increased regulation when located outside of where company typically conducts business

Answer 69

transferring data across boarders can result in organization subjecting themselves to additional laws and regulations surprise minimization rule- consumer should be able to assume their info is subject to protections afforded by their home jurisdiction laws regardless of where data is processed (no surprise)

Answer 70

GDPR contains most prominent and well known set of international data transfer rules must have valid basis to transfer data 1. adequacy decisions 2. adoption of appropriate safeguards 3. derogations (exceptions such as explicit consent)

Answer 71

determine 3rd party country data protection regulations are equivalent to or grater than those under GFPR US previous privacy frameworks struck down under adequacy decision 1. safe harbor program- struck down in Schrems I based on concerns of surveillance programs disclosed by Edward Snowden 2. privacy shield framework- struck down in Schrems II (2020) current framework of US= trans- Atlantic data privacy framework (2022) 1. adequacy decision is not final yet

Answer 72

binding corporate rules (BCRs) - set procedures and policies org voluntarily agrees to follow (form of fair info practices) to cover its internal handling of personal data -no third party transfers!!!!! standard contract clauses (SCCs) - company contractually promises to comply with EU law and submit to jurisdiction of EU privacy supervisory agency - Schremes II upheld validity of SCCs but raised concerns about whether it is permissible means to transfer data since it must be noted they must be prohibited if they don't comply with 3rd country legal protection required ad hoc contract clauses (disfavored) - parties can draft own contract clauses when SCCs are not appropriate codes of conduct/approved certification mechanism - co-regulatory programs where org is required to undertake bidding and enforceable obligation to abide by code of conduct

Introduction to US Privacy Environment (35 questions) Flashcards

(97 cards)