Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CIPM > 4: Privacy Operational Life Cycle: Assess: Data Assessments > Flashcards

4: Privacy Operational Life Cycle: Assess: Data Assessments Flashcards

1
Q

What is a data assessment?

A

inventory, manage and track information
determine the impact organizational systems and processes will have on privacy
Tools to help organizations identify privacy risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Examples of data assessment tools?

A

PIA’s
DPIA (data protection impact assessments)
Data Inventories (aka data-mapping assessments)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Three Lines Model wrt enterprise risk management

A

1: Periodic privacy risk assessments
2:compliance or privacy function
3: internal audit function

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Data Governance Framework

A

framework provides the approach to collect, manage, secure and store data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Ten Data management areas

A
  1. Data Architecture
  2. Data Modeling and Design
  3. Data Storage and Operations
  4. Data Security
  5. Data integration and interoperability
  6. Documents and content
  7. Reference and master data
  8. Data warehousing and BI
  9. Metadata
  10. Data quality
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Data Governance within an organization (at what levels)?

A

Strategic - a data steering committee with C level individuals. Steers and approves corporate data strategy, data governance, and data policies
Managerial - data owners, business leads responsible for data domain or data asset. Accountable for delivering data
Operational - data stewards, SMEs in a data domain or data asset responsible for the day-to-day management

Required for Article 30 of GDPR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Purpose of a Data Inventory (Map)

A

Where does the data reside? how is it used? why is it important? how does it move across systems? how is it shared and organized? where is it physically located?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What should a Data Inventory include?

A
  • the nature of the repository (context and purpose?)
  • the owner of the repository
  • legal entity of the processing
  • volume of information in the repository
  • format of the information
  • use of the info
  • data retention
  • types of info
  • where is it stored?
  • where is it accessed?
  • international transfers (where does the data flow)?
  • whom is the data shared with?
  • transfer mechanisms
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Processing Activities (Art 30 GDPR)

A
  • the name of the controller/processor, DPO or data protection rep
  • name and contact of joint controllers
  • purpose for processing
  • categories of personal data and data subjects
  • categories of recipients
  • any international transfers to other countries
  • safeguards for exceptions transfers of PI to third countries or international orgs
  • retention periods
  • general description of the technical and org security measures
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How to gather info to create a data inventory

A
  • identify and interview data owners, or functional leads if owners unknown
  • records or data team (data custodians - holders of the data)
  • digital marketing team
  • corporate counsel team
  • IT (DBA’s, back ups and continuity (what is retained, what needs to be restored))
  • software team
  • compliance team
  • Administrator who handles DSARs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Gathering info for data inventory - other things to consider

A
  • how is the data processed
  • type of encryption used
  • retention periods
  • who has access
  • who is it disclosed to
  • legal basis for processing the data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Three types of assessments and impact assessments…

A
  1. Privacy assessment
  2. Privacy Impact Assessment
  3. Data Protection Impact Assessment
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Privacy Assessment

A
  • measuring compliance with laws, regulations, adopted standards, internal policies and procedures
  • scope: education and awareness, monitoring and responding to regulatory environment; data, systems and process assessments; risk assessments; incident response; contracts; remediation; program assurance (incl audits)
  • may be internal or external
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Privacy Impact Assessment

A

analysis of privacy risks associated with processing PI in relation to a project, product or service
should suggest or provide remedial action or mitigations to avoid/reduce risks
PIAs help facilitate PbD

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Best time for a PIA?

A
  • early
  • during the ideation or scoping stage
  • with new or revised industry standards, org policies or laws and regs
  • when new privacy risks are created with changes in handling of PI
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Triggers for a PIA?

A
  • re-identification of information
  • conversions of records from paper to electronic
  • significant merging, matching and manipulation of multiple DB containing PI
  • Application of MFA
  • new uses or application for technologies
  • retiring systems that held PI
  • adding PI into existing DB
  • projects with a third-party service provider
17
Q

ISO & PIA’s (5 steps)

A
  1. Identifying information flow of PII
  2. Analyzing the implications of the use case
  3. Determining the relevant privacy - safeguarding requirements
  4. Assessing privacy risk using steps of risk identification, risk analysis and risk evaluation
  5. Prep to treat privacy risk using a privacy risk treatment option; determine controls and privacy risk treatment plans
    Follow up phase:
    prep and publish PIA report
    implement the privacy risk treatment plan
    review the PIA and reflect changes to the process
18
Q

DPIA - purpose

A

a process designed to identify risks arising out of the processing of personal data and to minimize the risks as much and as early as possible
tool to negate risks and demonstrate compliance with GDPR

19
Q

When is a DPIA required?

A

when processing is “likely to result in a high risk to the rights and freedoms of natural persons”
- automated processing, incl profiling, produce legal effects
- large scale of special categories of data or data related to criminal convictions
- systematic monitoring of a publicly accessible area on a large scale

20
Q

What should a DPIA include?

A
  • description of the processing, incl purpose and legitimate interest
  • necessity of the processing, proportionality and risks to data subjects
  • ## measures to address identified risks
21
Q

AI Privacy Challenges

A

Lawfulness, fairness and transparency
- AI inherits makers’ bias, algo might be unfair, algo may not be able to be disclosed (trade secret, IP), difficult to understand how the info is correlated and used
Data minimization and purpose limitation
- often takes huge amounts of PI
- not possible to predict what the algo will learn
- purpose may change as the algo learns
Integrity and confidentiality (security)
- large sets of training and testing data required, have to be copied and imported, shared and stored
- PI used to train AI system could be inferred (model inversion attacks and membership inference attacks)

22
Q

Privacy Awareness Education Program

A

Ensures employees are familiar with privacy concepts, risks, policies and procedures

23
Q

More advanced employee education includes:

A

role-based training, to equip employees to perform specific functions within the privacy program
i.e. teach managers how to assess privacy program compliance

24
Q

Ongoing Assessments

A
  • check that employees comply with program requirements
  • inspect systems that store and process data
  • verify compliance with external regulations
25
Q

Data minimization

A

ensure that data are only collected, processed, shared and stored as needed
Records management policies

26
Q

DLM

A

Data Lifecycle Management
- framework for managing data as it move thru out an org

27
Q

DLM goals (3)

A
  1. data security and confidentiality
  2. data integrity
  3. data availability
28
Q

DLM Stages

A
  1. Data Collection, acquisition or creation
  2. Data Storage, organization and backup/recovery
  3. Data Usage, Sharing and Processing
  4. Data Archiving
  5. Data Destruction
29
Q

Risk Assessment Methods

A

PTA - privacy threshold analysis
PIA - Privacy impact analysis
DPIA - data protection impact analysis
LIA - Legitimate interest analysis
TIA - transfer impact analysis

30
Q

Evaluation of Processors and Third-Party Vendors

A

questionnaires for vendors

  • Privacy and information security policies
  • Access controls
  • where PI is being held
31
Q

3rd party assessments - sources of info include:

A
  • internal audit (Program Assurance)
  • information and physical security - should compliment the privacy program
  • Data protection authority
32
Q

other considerations for 3rd party assessments:

A
  • risk assessment
  • technologies and processing methods
  • legal compliance
  • contractual requirements (incident response, etc)
  • cross border transfers
33
Q

Things to consider for Mergers, Acquisitions and Divestitures

A
  • due diligence
  • contractual and data sharing obligations
  • risk assessment and alignment
  • post-integration planning and risk mitigation

CIPM (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions