Alphabet Soup Flashcards
1
Q
FTC
A
Federal Trade Commission.
* Lead Agency for Privacy Enforcement
*Protects consumers against unfair and deceptive practices
* Enforces COPPA
*Lacks authority over financial institutions
2
Q
OCC
A
Office of the Comptroller of the Currency. Supervises national banks and thrift initiatives as well as foreign banks that have federal licenses to operate in the united states.
3
Q
HHS
A
Department of Health and Human Services.
4
Q
HIPAA
A
Health Insurance Portability and Accountability Act.
* Applies to PHI
* Applies to covered entities.
5
Q
FCC
A
Federal Communications Commission.
6
Q
DOC
A
Department of Commerce
*Implements the EU-US Privacy Shield
7
Q
CCPA
A
California Consumer Privacy Act
8
Q
NAI
A
Network Advertising Initiative
9
Q
BBB
A
Better Business Bureau
10
Q
PCIDSS
A
Payment Card Industry Data Security Standard.
11
Q
OECD
A
Organization for Economic Cooperation and Development. Developed GPEN. The US is a member to both.
12
Q
GPEN
A
Global Privacy Enforcement Network - 5 Goals
*Exchange information about privacy issues
*Encourages sharing of information expertise
*Promotes dialogue among enforcement groups
*Facilitates international cooperation
*SUpports international privacy practices
13
Q
GDPR
A
General Data Protection Regulation
*Claims worldwide jurisdiction over the personal information of EU residents
14
Q
Standard Contractual Clauses
A
15
Q
Binding Corporate Rules
A
16
Q
Privacy Shield safe harbor
A
Not currently available. Schrems II.
17
Q
APEC
A
Asia-Pacific Economic Cooperation
18
Q
HIPAA Penalties
A
Civil
*$100 for first-time unknowing offenses - $50,000 for uncorrected willful neglect
Criminal
*$50k and one year in prison knowingly obtaining protected information up to $250k and 10 years in prison if intent to use to commercial advantage, personal gain, or malicious harm
19
Q
Unfair Business Practices
A
3 Requirements
*Must cause or likely to cause substantial injury to customers
* Must not be reasonably avoidable
*Must not be outweighed by the benefits
20
Q
Deceptive Business Practices
A
3 Requirements
*Must be making a misleading representation, omission, or practice
*Must be analyzed from the perspective of a reasonable customer
*Must be material
21
Q
How many people are in the House of Representatives?
A
435 members
22
Q
How many people are in the Senate?
A
100 members
23
Q
How many votes to overcome a veto?
A
2/3 Majority in the house and senate
24
Q
Where are federal administrative laws encoded?
A
CFR - Code of Federal Regulations
25
How many votes to amend the constitution?
2/3 Majority in congress and 3/4 ratification by the States.
26
CFR
Code of Federal Regulations. Where federal administrative law is codified
27
Article 1
Legislative Branch
28
Article 2
Executive Branch
29
Article 3
Judicial Branch
30
UCC
Uniform Commerical Code
31
Article 4
Relationship between states
32
Article 5
Amending the constitution
33
Article VI
Supreme Law
34
Article Vii
Ratification
\
35
Supremacy Clause
36
FTC Enforcement Actions
Most FTC complaints are not resolved through formal processes but use two other settlement mechanisms.
* The FTC and the accused company may decide to informally resolve minor complaints by adjusting the company's business practices.
* In more serious cases, the FTC and the company may enter into a consent decree.
37
Consent Decree
This is a formal, enforceable, agreement between the company and the government requiring the modification of business practices. Generally lasts 20 years unless otherwise specified. "Sunset Policy"
38
LifeLock
Violated at FTC consent decree and was forced to renew the consent decree and pay a fine of $100m
39
CFBP
Consumer Financial Protection Bureau. Overall authority for protecting consumers in the financial industry.
40
Federal Reserve
Supervises and regulates banks operating in the US
41
NCUA
National Credit Union Association. Similar regulations to the federal reserve.
42
FDIC
The Federal Deposit Insurance Corporation. Holds regulatory authority to examine and supervise financial institutions for safety, soundness, and consumer protection.
43
Chief Privacy Officer
A chief privacy officer has broad oversight over an organization's privacy practices
44
Consent
Two types:
Opt-In Consent - Affirmative consent takes place when the user explicitly agrees to a privacy practice
Opt-Out Consent - Implicit consent occurs when the user does not take action to explicitly deny consent
45
PII
Personally Identifiable Information
Any information that can be used to distinguish an individual's identity or any information that is either linked or linkable to an individual.
46
Privacy Notice Components (Generally)
*Types of information collected
*Purpose of data collection
*Methods of collection
*Times of collection
*Sharing of information
*Security controls
*Opt-in and opt-out procedures
*Contact information
47
Difference between Privacy Policy and Privacy Notice (1 key distinction)
Generally, Privacy Policies are internal documents, Privacy Notices are external documents
48
NIST
National Institute of Standards and Technology
49
NiST 800-61
Computer Security Incident Handling Guide
50
Incident response plan
Should include 5 components (per NIST 800-61)
*Policy and plan documentation
*Procedures for incident handling
*guidelines for communicating externally
*structure and staffing model for the team
*Description of relationships with other groups
51
Incident Response Policy
The cornerstone of the Incident Response Plan (Shouldn't change often)
*Provides foundational authority for the program
*Defines incidents that fall under the policy
*Include an incident prioritization scheme
52
Incident Response Procedures
Contain the details of the plan.Should be written clearly and provide actionable advice. Should include procedures for:
*notification
*escalation
*Reporting
*system isolation
*forensic analysis
*evidence handling
53
What to know about reporting a cyber security incident to law enforcement.
Generally not required. An investigation invites additional risks and regulations. The likelihood that details of the incident will become public. Always report to law enforcement if there is a threat to safety or if you have a legal obligation to do so.
54
Basis for FTC Enforcement Actions
Corporate privacy policies often provide the basis for FTC enforcement actions.
55
COPPA
Children's Online Privacy Protection Act
* Protects the PII of children under the age of 13
* Applies to commercial sites that are directed at children under the age of 13 or if commercial sites have knowledge that their site is being used by children under the age of 13.
* Companies may avoid enforcement actions through self-regulation by participating in COPPA Safe Harbor Programs.
Enforced by the FTC
* COPPA does not apply to most nonprofit orgs
56
COPPA Privacy Requirements
*Post a clear and comprehensive privacy policy
* Notify parents of privacy practices
* Obtain verifiable parental consent prior to collecting, using, or disclosing information from children.
* Provide parents with the ability to review collected information and prohibit further use
57
COPPA Security Requirements
* Protect the confidentiality, security, and integrity of personal information
* Delete information when no longer needed
* Do not require that children provide unnecessary information
58
Wyndham
FTC alleged Wyndham suffered a series of data breaches as the direct result of their failure to implement reasonable security controls. FTC prevailed at the Court of Appeals.
59
HIPAA Covered Entities
* Healthcare providers who engage in certain electronic transactions
*Health plans
* Health information clearinghouses
* Business partners of HIPAA covered entities
60
PHI
Protected health information
61
BAAs
Business associate agreements
* Extend HIPAA to the business partners of covered entities
62
HIPAA Exceptions
* Employer records
* Education records covered by FERPA
* Deidentified information
63
HIPAA Privacy Rule key provisions
Governs the privacy of protected health information (PHI)
* Notify of privacy practices
* Permitted uses of PHI
* Minimum use and disclosure of PHI
* Right to review records
* Controls to protect confidentiality and integrity of PHI
64
HIPAA Security Rule
Governs the security of electronically protected health information (ePHI)
* Controls to protect confidentiality, integrity, and availability
* Identify and protect against threats
* Protect against impermissible uses of disclosures
* Ensure workforce compliance
65
HITECH
Health Information Technology for Economic and Clinical Health Act (2009) with the intent of modernizing health care.
*Incentivized the use of electronic health records.
66
EHR
Electronic health records.
67
HITECH updates to HIPAA
* Breach notification requirements.
* Business associates must comply with the provisions of HIPAA allowing the federal government to take direct action against business associates who fail to comply with HIPAA rules.
* Strengthened privacy protectio
68
Breach Notification Exceptions (HITECH-->HIPAA)
* Encrypted information
* Unintentional access by employees (good faith)
* Inadvertent disclosures between authorized individuals.
* Disclosures to individuals who would not be able to retain the information.
69
Breach notification requirements (HITECH-->HIPAA)
Breach notification requirements.
* Notify affected individuals within 60 days. (small breach)
* Notify the media if the breach affected more than 500 individuals (large breach)
* Notify covered entities of breaches by business associates
* Notify HHS of all data breaches. (within 60 days for large data breach, smaller breaches within the calendar year)
70
21st Century Cures Act
Introduces penalties for information blocking
* Fines up to $1m per violation.
Allows compassionate sharing of mental health and substance abuse treatment information with families and caregivers.
Introduces privacy provisions to facilitate biomedical research
71
Confidentiality of Substance Use Disorder Patient Records regulations
42 CFR Part 2.
Covers treatment records that could identify a patient
Applies to any substance abuse treatment program accepting federal funding.
Violations are criminal offenses with fines of up to $500- $5000 per violation.
Requires written patient consent for all disclosures of information
72
Exceptions to consent of Confidentiality of Substance Use Disorder Patient Records regulations
* medical emergencies
* Research
* audits and evaluations
* qualified service organizations
* child abuse and neglect
* reporting on-premises crimes and crimes against program personnel
* Court-ordered disclosures
73
FCRA
Fair Credit Reporting Act (1970). Applies to consumer reporting agencies.
* Limites permissible uses of credit reports
* Requires fair and accurate information reporting. (correct and current). Negative information may only be on an account for seven years.
* Provides right to access and dispute information. Disputes must be resolved within 30 days. requires notifying consumers of adverse actions taken because of any information provided in the report.
* Requires notification of adverse actions
74
Defining credit reports
written, oral, or any other form of communication by a consumer reporting agency that provides information that may be used for the purpose of credit or employment purposes
* creditworthiness
* credit standing
* credit capacity
* character
* general reputation
* personal characteristics
* mode of living
75
Consumer Reporting Agencies
Any person or organization who regularly engages in the practice of assembling or evaluating consumer credit information and shares reports about that information with third parties.Users of credit reports must provider certification of their intended use.
76
When is sharing permitted with a third-party under the FCRA?
* responding to a court order
* with the written permission of the consumer
* or with the third-party meeting certain criteria including
1. facilitating credit transactions
2. making employment decisions
3. underwriting insurance policies
4. issuing licenses and government benefits
5. other legitimate business needs
77
Adverse Action Notices
Provided with an adverse action is taken because of information provided in a credit report. Requires:
* Contact information for a credit reporting agency (CRA)
* A statement that the CRA did not make the adverse decision
* Notice of right to access report
* Notice of right to dispure report
* Credit scores used to make decisions.
78
CRA
Credit Reporting Agency.
79
FCRA Penalties
Weighted in favor of consumer rights. Consumers may recover
* Actual damages
* Punitive damages
* legal costs
80
FACTA
The Fair and Accurate Credit Transactions Act seeks to limit the risk of identity theft. (2003). Modifies FCRA. Largely used to limit information obtained in a credit report for identity theft.
* Consumers may obtain free copies of their credit reports annually.
* May place 90-day fraud alerts on their credit files. (may extend to 7 years if a victim in fact)
* Reciepts may contain no more than 5 digits of a credit card on a receipt.
* Red Flag Rule
* DIsposal Rule (reasonable and appropriate destruction)
81
Red Flags Rule
Under FACTA. Requires institutions to have a written identity theft protection program. Doesn't specify how per se beyond industry experience.
*Requires address change validation
*CRA's notify users when there is an address discrepancy.
82
GLBA
Gramm-Leach-Bliley Act overhauled the regulation of financial institutions in the United States. Officailly called the Financial Services Modernization Act of 1999.
* Applies to all businesses that are significantly engaged in providing financial products and services
* Financial Privacy Rule
* Safeguards Rule
83
GLBA Financial Privacy Rule
Limits how financial institutions may collect and share nonpublic personal (NPI) of consumers.
* provided to customers upon engagement and annually
* describe privacy policies and practices
*disclose third-party information sharing
*describe information security policies and practices
*provide the ability to opt out
84
NPIC
nonpublic personal information of consumers
85
GLBA Safeguards Rule
Re
86
GLBA Safeguards Rule
Requires that financial institutions develop a written information security plan. Requires how institutions protect the
*Confidentiality
*Integrity
*Availability
of financial information.
87
GLBA Scope
This applies to all businesses that are significantly engaged in providing financial products and services. Including:
* banks
*non-bank lenders
*financial advisors
*check cashing services
* payday lenders
*real estate appraisers
*tax preparers
*mortgage brokers
*ATM operators
*Colleges and Universities that issue student loans
88
GLBA Privacy notice requirements
* provided to customers upon engagement and annually
* describe privacy policies and practices
*disclose third-party information sharing
*describe information security policies and practices
*provide the ability to opt out
89
Customers vs. Consumers according to the GLBA
Consumers are individuals who engage in transactions with a financial institution. May be a one-time engagement. (Cashing a check). Consumers may receive a short-form notice of privacy requirements under the GLBA.
Customers are consumers who have an ongoing relationship with a financial institution. (opening an account). Customers must receive the institution's full privacy notice.
90
GLBA security plans
Under the GLBA Safeguards Rule. Must:
* Designate one or more responsible employees.
* Identify and assess risks
* Evaluate safeguard effectiveness.
*Monitor and test safeguards
* Use secure service providers
*Evaluate and Adjust program as circumstances change
91
States with GLBA Exemptions
CCPA specifically excludes financial information collected under GLBA. This does not exclude financial institutions from the requirements of CCPA.
*California
*Colorado
*Nevada
*Virginia`
92
Dodd-Frank Act
Dodd-Frank Wall Street Reform and Consumer Protection Act of 2008 reorganized the regulation of financial institutions. Most significantly, established the CFPB.
93
CFPB
Consumer Financial Protection Bureau took over rule-making authority for the FCRA and GLBA. Has the power to regulate unfair, deceptive, or abusive acts and practices by consumers of financial products and services. Also regulates the use of credit reports in employee background checks.
94
UDAAPs
unfair, deceptive, or abusive acts and practices. Unfair and Deceptive similar to the definitions used by the FTC. Abusive Practice is new. Each act may be separate.
95
Abusive Practice
New under the CFPB.
* Materially interferes with the ability of a consumer to understand a term or condition.
*Takes unreasonable advantage of 1) lack of consumer understanding, 2) inability to protect interests, or 3) reasonable reliance of providers to act in the consumer's interest
96
FERPA and scope
Family Educational and Privacy Act (1974). Applies to most educational institutions in the US.
* Covers all educational records
* Most colleges and universities
* Most public schools
*Does not apply to most private schools
* Parents maintain rights under the age of 18; Students maintain rights over 18 or postsecondary education.
* Annual notice of rights to students/parents
97
Parental rights under FERPA
* Control disclosure of records to third parties
* Access student educational records
* Dispute information in student educational records
98
Educational Record types under FERPA
* Grades
* Transcripts
* Class lists
* Course schedules
* Health records (k-12)
* Financial records (postsecondary)
* Disciplinary records
99
FERPA record exclusions
* Law enforcement records maintained by campus police
* Application records of nonstudents
* Alumni records created after a student graduates
* Medical and mental health records for the treatment of students (usually)
* Sole-possession records unless shared (eg. created by an individual faculty member)
* Peer graded work before it's entered as a grade.
100
Permitted disclosures under FERPA
* Consent
* Not personally identifiable
* directory information (not generally be considered harmful or an invasion of privacy if disclosed: name, phone, address, major, etc.)
* Health or safety emergency
101
Permitted recipients of protected FERPA information without consent
* School officials with "legitimate educational interest"
* Other educational institutions
* Financial aid organization
* Researchers
* Accrediting agencies
* Law enforcement agencies
102
TCPA
Telephone Consumer Protection Act grants authority to FCC regulated unsolicited advertising by phone and fax.
103
TSR
Telemarketing Sales Rule established by the FTC.
* Established Do Not Call Registry
* Calls may only be placed between 8 am-9 pm
* Must display valid caller ID
* Identify themselves
* Live person within 2 seconds
* Automated calls only with express consent of the consumer
104
Do Not Call Registry
* Contains 200 million numbers
* Prohibits unsolicited sales calls to landlines and cell phones without explicit consent
* Telemarketers must purchase a subscription to the registry, update their database every 31 days
* Fines for violators over $43k per violation.
* Applies to only unsolicited sales calls.
105
Dish Network
$280m fine for violating restrictions of the DO Not Call Registry
106
Exceptions to Do Not Call Registry
* Debt collection calls
* Nonprofits seekings gifts
* Political calls
* Surveys
* Prior customers (18 months)
* Prospective customers who have inquired (3 months)
107
EBR
Existing Business Relationship exception to telemarketing laws.
* Prior customers (18 months)
* Prospective customers who have inquired (3 months)
* For JFPA: voluntary provision of fax number with opt-out instructions on first page
108
Telemarketing Safe Harbor
The exception to accidental violation of Do Not Call Registry by a telemarketer.
* Must have written procedures for compliance
* Trained personnel on these procedures
* Monitor and enforce compliance
* Maintain internal do-not-call list
* Download the national registry every 31 days
* must be a mistake
109
JFPA
Junk Fax Prevention Act
Illegal to send unsolicited advertisement by fax
* $500 fine per page
* $1500 fine per page is knowing or willful
110
CAN-SPAM Act
Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003.
* Applies to commercial emails primarily
* FTC Enforcement - 7 rules
1. don't use false or misleading header
2. don't use deceptive subject line
3. identified as an advertisement
4. tell recipient where you're located
5. provide opt-out instructions
6. honor opt-out promptly (within 10 business days)
7. monitor what others are doing on your behalf
111
Categories of emails under CAN-SPAM
Commercial, Transactional/Relationship, and other.
* Transactional: 1) facilitate or confirm a transaction, 2) provide warranty, etc. 3) change of terms, 4.) employment relationship, 5) delivery of goods/services
112
Telecommunications Act
Telecommunications Act of 1996. Particularly interest in the CPNI
113
CPNI
Customer Proprietary Network Information. Information related to a subscriber's use of a telecommunications service. Regulated by the FCC
* call details, billing, services.
* may be used internally
* may be used for customer communication, customer service, fraud prevention, billing and collections, and court order or emergency.
* Other use require consent\
* pretext security requiring passwords or photo ID if in person.
* carriers require law enforcement notification if breach.
* annual compliance certification with the FCC
114
CCPA
Cable Communications Policy Act
* Regulated cable television industry.
* prohibited from collecting PII w/o prior consent unless necessary
* may not disclose PII unless required to provide service absent court order
* annual notice of privacy practices to customers
* customers may access PII and update/correct
* PII destruction mandated after necessary use
* Private right of action
115
VPPA
Video Privacy Protection Act of 1988 prohibits wrongful disclosure of videotape rental or sales records.
* Courts have adopted VPPA to video streaming services.
116
GAPP
Generally Accepted Privacy Principles - 10 principles
1. management - policies, procedures, governance structure for data. Clearly define roles of data owner, data steward, and data custodian.
2. Notice - subjects recieve notice and access
3. choice and consent
4. collection - only collect what is disclosed
5. use, retention, and disposal
6. access - review and update for subjects
7. disclosure to third parties
8. security
9. quality - accurate, complete, and relevant
10. monitoring and enforcement, with dispute resolution process.
117
DPPA
Driver's Privacy Protection Act regulates sharing of driver records by state DMV. Several incidents of DMV's sharing information with dangerous consequences. Third-party sharing also subject to DPPA provisions. May share with
* government agencies
* stolen vehicles
* managing records and titles
* impounded vehicles
* criminal or civil proceedings and investigations
* research absent PII
* Employer verification
* tolls
* operation of motor vehicles
* public safety
118
RFPA
Right to Financial Privacy Act. Broadly covers financial institutions (banks, credit unions, money services businesses, document firms, casinos, and the post office).
* Applies only to requests made by federal agencies.
* Only covers specific customers.
* request must reasonably identify the records
* requests must be justified by one of the following: 1) customer authorization, 2) admin summons/subpoena, 3) judicial summons/subpoena, 4) search warrant, 5) written law enforcement request (absent summons/subpoena otherwise)
* Written notice to customer required and then 10 days from service or 14 days from mailing to access records.
119
BSA
Bank Secrecy Act of 1970 requires that financial institutions report certain customer information to the government. This act compels financial institutions to turn some records over to the government.
* Financial institutions must maintain records of customer activity for five years.
* CTR and SAR reporting required.
* Prohibits financial institutions from notifying customers they filed a SAR
120
CTR
Currency Transaction Reports
* Under the BSA institutions must report case transactions totaling more than 10k in a single day.
121
SAR
Suspicious Activity Report
* Under the BSA institutions must report suspected money laundering activity attempts to avoid CTRs
122
4th Amendment as applied to digital communications
Creates the right to a "reasonable expectation of privacy"
123
ECPA
The Electronic Communications Privacy Act regulates government access to communications. Consists of 3 individual titles.
* Title 1 - Wiretap Act covering oral communications. Primarily allowing one-party consent for wiretaps in the ordinary course of business.
* Title 2 - Stored Communications Act. Emails. Texts. Voicemails.
* Title 3 - Covers the use of pen registers and trap and trace devices
124
Pen Registers vs. Trap and Trace
Pen registers record information about outbound communications; trap-and-trace capture inbound communications. The distinction is a relic; the same tech tracks both outbound and inbound communications today.
125
True or false. Federal access to communications preempts state laws.
False. Not necessarily, state laws may have more stringent requirements. Most notably, many states require two-party consent to be recorded, while federally, one-party consent is the rule.
126
CALEA
Communications Assistance to Law Enforcement Act. No new authority for federal wiretapping. Requires that telecommunications carriers assist with the implementation of authorized wiretaps.
* Applies to telephone companies
* ISPs
* Voice oper Internet Protocol service providers (VoIP)
127
FISA
Foreign Intelligence Surveillance Act of 1978. Passed after the Cold War. Section 702 of the FISA Amendments Act of 2008:
* The AG may authorize surveillance for one year if the sole purpose is to obtain foreign intelligence and there is no substantial likelihood of intercepting communications involving US persons.
* Court order may involve US persons if there is probable cause to believe that the person is an agent of a foreign power. Must be renewed every 90-120 days.
* Established Foreign Intelligence Surveillance Court consisting of 11 judges who hold secret hearings to decide matters involving classified evidence.
128
USA Patriot Act
Introduced expanded powers.
* Loosened requirements for surveillance of US citizens
* Created "roving" wiretaps
* Strengthed rules against money laundering
* Broardened powers of NSL's
* Allowed government to demand "tangible items" including call detail records.(Section 215)
129
NSLs
National Security Letters. Administrative subpoenas to secretly demand records from communication service providers. Can be issued by the FBI without the need for a federal judge. Companies receiving a NSL are prohibited from talking about them.
130
USA Freedom Act
Patriot Act of 2001 expired in 2015. USA Freedom Act 2015 extended some provisions and added new controls to the Patriot Act.
* Eliminated bulk collection of call details. (SEction 215)
* Prohibited protection orders of bulk "tangible things" from the FBI
* Required the use of specific selector terms (telephone, email address, etc)
* Requires judicial involvement
* Required expert opinions required in FISA court. May send questions of law to the Supreme Court, subject to the declassification of FISA orders.
* NSL's must require specific selction terms, imposes a higher standard for gag orders, and allows recipients to challenge NSLs in court.
* Requires transparency letters by companies recieving NSLs.
131
CISA
The Cybersecurity Information Sharing Act of 2015 (CISA) facilitates information sharing. Does not require private orgs to share information with the government but seeks to make it easier to do so.
* Authorize sharing of threat intelligence between the government and the private sector
* Protects shared information from disclosure
* Requires redaction of personal information shared
* Limits liability for security monitoring.
132
Zurcher v. Stanford Daily
Birth of the Third-Party Doctrine
* The 4th Amendment does not prohibit searches of third parties.
* The 1st Amendment does not prohibit searches of newspapers.
133
Privacy Protection Act
Passed in response to Zurcher v. Stanford Daily. Applies to disseminators of information to the public and protects work products and documentary materials from search warrants.
* requires the use of subpoena or voluntary cooperation
134
USA Patriot Act
Introduced expanded powers.
* Loosened requirements for surveillance of US citizens
* Created "roving" wiretaps
* Strengthed rules against money laundering
* Broadened powers of NSL's
* Allowed government to demand "tangible items" including call detail records.(Section 215)
135
Department of Labor Authority
Administers and Enforces over 100 labor laws, including:
* Fair Labor Standards Act (FLSA)
* Occupational Safety and Health Act (OSHA)
* Employee Retirement Income Security Act (ERISA)
* Employee Polygraph Protection Act (EPPA)
* Family and Medical Leave Act (FMLA)
136
EEOC
Equal Opportunity Employment Commission enforces prohibitions on employment discrimination. Requires record retention on employment decisions for 1 year (generally), 2 years for federal stuff
137
NLRB
National Labor Relations Board regulates the rights of workers to organize in labor unions.
138
SEC
The Securities and Exchange Commission requires reporting of human resources information by publicly traded companies. So far only requires reporting the number of people employed. May be new regulations in the future.
139
CRA
Title 7 of the Civil Rights Act.
Prohibits discrimination on the basis of sex, race, color, national origin, or religion.
140
ADA
American with Disabilities Act prohibits discrimination against individuals with disabilities. Must meet the requirements of the job and be able to perform the functions of the job with reasonable accommodation to gain protections in employment. Prohibits medical examinations from employment decision.
141
GINA
The Genetic Information Nondiscrimination Act prohibits the use of genetic information in employment decisions.
142
FCRA and background screening.
Fair Credit Reporting Act. Not limited to financial information.
* Must provide applicant written notice and obtain written consent
* Certify to the credit reporting agency that you provided notice, obtained consent, and will not discriminate
* Investigative report must include a description and scope of the investigation.
143
EPPA
Employee Polygraph Protection Act prohibits the use of lie detectors in most employment settings. This does not apply to federal, state, local governments. May use in some cases for employee theft
144
Drug testing regulations.
Generally not prohibited by federal law, however, state laws vary widely and the ADA covers alcoholism and past drug use.
145
SCA
Stored Communications Act
146
Does the target of an employer investigation require notice or consent?
Does the target of an employer investigation need to be given a copy of the investigation report?
No.
No.
147
If an employer take an adverse action on an employee based on an investigation into misconduct, what must be provided to the employee?
The summary report must be provided to the employee and include the nature and substance of the report. It may exclude witness names. Report may only be shared within the organization or otherwise required by law.
148
CFIPA
California Financial Information Privacy Act, Senate Bill 1 (SB 1)
* Expands of GLBA
* Restricts financial institution sharing of customer information with third parties, shifts to opt-in consent requiring written consent
* Requires notification to customers on privacy policy on a separate document titled :Important Privacy Choices for Consumers"
149
CalECPA
California Electronic Communications Privacy Act expands on the federal ECPA. Restricts state law enforcement authority's access to electronic information in two ways:
1) access to service provider records by warrant, court order, or subpoena,
2) access to electronic devices by warrant, wiretap order, consent of the customer, or certification of an emergency situation (death or serious injury)
*only applies to CA law enforcement agencies
150
CCPA
California Consumer Privacy Act modeled after GDPR
* right to know what information is collected by businesses
* right to know how information is shared with third parties
* right to opt out of information sharing
* right to review information
* right to request deletion of information
151
What are the two CCPA acronyms?
California Consumer Privacy Act
Cable Communications Policy Act
152
CPRA
California Privacy Rights enforcement Act (2023)
* Creates new category of Sensitive Personal Information (SPI) that is more highly regulated under CPRA. Businesses need additional protections around ssns, driver's license numbers, financial account information, geographic location information, the contents of non-public communication, health and genetic information, and information about an individual's ethnicity, religion, philosophy, sex life, or union membership
* right to correct
* right to limit use and disclosure
* right to information about automated decision-making concering information
* right to opt-out of automated decision making
153
Colorado Privacy Act
Similar to CCPA and CPRA.
* Applies to businesses that conduct business in Colorado or target residents of Colorado if handles information of 100,00 residents or handles PII of 25,000 or more residents and earns revenue from sharing that information.
* DOes apply to nonprofit organizations
* Does not apply to employers
* Does not contain a private right of action
154
DOPPA
Delaware Online Privacy and Protection Act
1. Websites must post privacy policies - must be conspicuous, identify PII collected and third party sharing, disclose d"o not track requests", and notification of changes to the privacy policy
2. Ebook providers must safeguard user information absent court order or subpoena
3. Websites targeting children must restrict advertising (prohibited: alcohol/tobacco/drug paraphernalia, firearms/fireworks, tanning services, dietary supplements, lottery/gambling/body modification/sexually oriented material
155
Illinois Personal Information Protection Act
1. Implement reasonable security measures to protect PII of Illinois residents
2. Delete PII when no longer needed
3. Notify residents of data breaches affecting their PII
156
SOPPA
Student Online Personal Protection Act (Illinois) similar to FERPA
* parents have greater control of student information
* requires data breach notification
* applies both to government agencies and educational technology companies
157
Nevasa SB 538
* websites that collect any of the following PII are required to post a privacy policy. PII includes names, addresses, email addresses, phone numbers, ssns, and any identifiers
* Notice requires 5 elements, 1, categories of PII. 2. describe process to review and correct, 3. notify process for policy changes, 4. disclose use of third-party tracking services, 5. include an effective date
* violators subject to fines of $5k
158
Nevada SB 260
Expanded law to cover data brokers who purchase PII
159
NJPIPPA
The New Jersey Personal Information and Privacy Act regulates the scanning of identification cards by retail establishments with several reasonable exceptions, prohibits sharing information collected for other purposes, and violations and breaches must be reported to authorities.
* includes private right of action and fines up to $5k
160
NYDFS
New York State Department of FInancial Services regulates banks, insurance companies, and financial service providers. Published a comprehensive cyber security regulation for affected industries.
* Requires all covered entities to create a risk based cybersecurity program that addresses confidentiality, integrety, and availability of security protocal
* Covered entities must designate a Cheif Information Security Officer (CISO)
161
VCDPA
VIrginai Consumer Data PRotection ACT (2023)
* Applies business conducted in Virginia and residents of Virginia
* Exemptions: Virginia government, business subject to GLBA, orgs subject to HIPPA, nonprofits, secondary schools
* no private right of action
162
Washington State's biometric privacy law
controls commercial use of biometric information.
* Excludes photo, video, and audio recording
* Companies may not store biometric info collected absent notice, consent, and mechanism preventing commercial use
* limits sharing with third parties
* collected biometric data must be protected against unauthorized access, disposed of unneeded info, used only for agreed upon purpose
163
Does the federal government have a data breach notification law?
NO.
164
First and Last states to pass data breach notification laws.
California (1st) and Alabama (last)
165
Tennessee SB 2005
* Includes encrypted information in definition of PII
* Notice period of data breach to 14 days
* Data breach includes access by employees for illegal purposes
166
Illinois HB 1260
Expands the definition of PII to include health records, biometric data, and usernames/passwords
* removes the encryption safe harbor if the key was compromised
167
California AB 2828
* removes the encryption safe harbor if the key was compromised
* allows businesses to delay notification of a breach at the request of law enforcement
168
New Mexico HB 15
* Includes biometric data in definition of PII
* Requires breach notification to NM AG is more than 1000 residents affected
* Exempts GLBA and HIPAA covered entities
* requires secure data storage and disposal
