Ch. 2: US Legal Framework Flashcards
What are the sources of U.S. law?
- Constitutions
- Legislation
- Regulations and Rules
- Case Law
- Common Law
- Contract Law
Is the right to privacy explicit in the U.S. Constitution.
No,
the word “privacy” is not in the U.S. constitution. However, some parts directly affect privacy such as the 4th Amendment which limits government searches. State constitutions may create stronger rights than those found in the U.S. constitution. For example, CA state constitution expressly recognizes a right to privacy.
What is legislation?
Laws passed by Congress or state legislatures.
What are Regulations and Rules?
Compliance expectations placed on the marketplace by regulatory agencies.
Some laws require regulatory agencies to issue regulations and rules.
What is Case Law?
Final decisions made by judges in court cases. When similar issues arise in the future, judges look to past decisions as precedent and decide the case in a manner consistent with past decisions - “stare decisis”
What is Common Law?
Legal principles that have developed over time in judicial decisions, often drawing on social customs and expectations.
What is a Consent Decree?
A judgment entered by consent of the parties whereby the defendant agrees to sop alleged illegal activity, typically without admitting guilt or wrongdoing. The legal document is approved by the judge and formalizes an agreement reached between a federal or state agency and an adverse party. The document describes the actions the defendant will take, and my be subject to a public comment period.
What is Contract Law?
It is a subcategory of Common Law.
What are the fundamental requirements for forming a binding contract?
- Offer
- Acceptance
- Consideration
What is an Offer?
Proposed language to enter into a bargain. It must be communicated to another person and remain open until it is accepted, rejected, retracted or has expired. A counteroffer ends the original offer.
What is Acceptance?
The assent or agreement by the receiver of the offer that the offer was accepted. Acceptance must be communicated to the offeror.
What is Consideration?
Is the bargain-for exchange. Legal benefit received by one person and the legal detriment imposed to the other. Consideration usually takes the form of money, property, or services.
What is Tort Law?
Are civil wrongs recognized by the law as the grounds for lawsuits. These wrongs result in an injury or harm that constitutes the basis for a claim.
What are the 3 general tort categories?
- Intentional Torts - wrongs that the defendant knew or should have known would occur through their actions or inactions.
- Negligent Torts - wrongs when the defendant’s actions were unreasonably unsafe.
- Strict Liability - wrongs that do not depend on the degree of carelessness by the defendant, but are established when a particular action causes damage.
What are examples of Privacy Torts?
intrusion upon seclusion, public revelation of private facts, casting a person in a false light, interfering with a person’s right to publicity, failing to provide adequate safeguards for PI
What is a Person?
Any entity with legal rights, including an individual or a corporation.
What is the meaning of Jurisdiction?
The authority of a court to hear a particular case. The court must have subject matter jurisdiction and personal jurisdiction.
What is Preemption?
A superior government’s ability to have its laws supersede those of an inferior government.
What is “Private Right of Action”?
The ability of an individual harmed by a violation of law to file a lawsuit against the violator.
What is Notice?
Is a description of the organization’s information management practices.
What is the purpose of a Notice?
- consumer education
2. corporate accountability
What does a typical Notice tell an individual?
- What information is collected
- How the information is used and disclosed
- How to exercise any choices about uses or disclosures
- Whether the individual can access or update the information
What is a Privacy Notice?
Often refers to external communications, issued to consumers, customers, or users.
What is a Privacy Policy?
Often refers to internal standards used within the organization.
What is Choice?
The ability to specify whether personal information will be collected and/or how it will be used or disclosed.
What is an “opt in” choice?
An affirmative indication of choice based on an express act of the person giving the consent.
What is an “opt out” choice?
A choice can be implied by the failure of the person to object to the use or disclosure.
What is Access?
The ability to view personal information held by an organization.
When must Access and Correction be provided?
When the information is used for any type of substantive decision making, such as for credit reports.
Which federal agencies engage in regulatory activities concerning privacy in the private sector?
- Federal Trade Commission (FTC)
- Federal Communications Commission (FCC)
- Department of Commerce (DoC)
- Department of Health and Human Service (HHS)
- Federal Reserve Board (Fed)
- Office of Comptroller of the Currency (OCC)
- Consumer Financial Protection Bureau (CFPB)
What privacy authority does the FTC have?
The general authority to enforce against “unfair and deceptive trade practices,” notably including the power to bring deception enforcement actions where a company has broken a privacy promise.
Who enforces privacy at the state level?
State attorney generals
How do state attorney generals bring enforcement actions?
Typically, pursuant to state laws prohibiting unfair and deceptive trade practices.
Who also plays a valuable role in governing privacy practices within industries?
Self regulatory regimes
What questions should be asked to understand any privacy related law, statute, or regulation?
- Who is covered by this law?
- What types of information (and what uses of information) are covered?
- What exactly is required or prohibited?
- Who enforces the law?
- What happens if I don’t comply?
- Why does this law exist?
What do the first 2 questions do?
Tell you the scope of the law.
What does the third question do?
Tells you what you need to know to comply with the law
What does questions 4 and 5 do?
They help you assess the risks associated with noncompliance or less than perfect compliance.
What does question 6 do?
Helps you understand the motivation behind the law.
What are the 3 Branches of the U.S. Government? & What is the role of each branch?
Executive Branch
Enforces laws
President, Vice President, Cabinet and Federal Agencies
Legislative Branch
Makes laws
Congress (house of representatives and senate)
Judicial Branch
Interprets the law (determines if constitutional)
Federal courts
What are SOURCES of law?
U.S. Constitution State Constitutions Legislation Regulations and Rules Common Law/Case Law Contract Law
What is the Supreme Law in the United States?
The U.S. Constitution
Where is the word “Privacy” mentioned in the U.S. Constitution?
The word Privacy is NOT mentioned in the U.S. Constitution
What is legislation?
Laws passed by federal and state legislatures.
What is Common or Case Law?
Final decisions by judges in court cases.
Judges look at precedent (past decisions) to decide how to rule in a new case that is consistent with these past decisions.
Laws/Precedents change, as technological and societal values evolve over time
What is required to have an enforceable (legally binding) contract?
Offer (terms of the agreement)
Acceptance (by the person to whom the offer was made), and
Consideration (bargained for exchange (e.g., money, property or services)).
Does the U.S. Constitution always override the State Constitution?
No, State Constitutions can create stronger rights than those provided by the U.S. Constitution
Do Federal Laws always override State Laws?
No, State Legislation may be stricter than national legislation. Federal law only override less strict state laws.
Who issues Regulations and Rules?
Regulations and Rules are issued by regulatory agencies (e.g., FTC and FCC) placing compliance expectations on industries
What AMENDMENTS to the United States Constitution have been interpreted to provide privacy protection?
3rd Amendment (Soldiers Quartered) 4th Amendment (Search and Seizure) 5th Amendment (Self-Incrimination) 14th Amendment (Due Process)
What is Jurisdiction?
The authority of a court to hear a particular case
What is the legal definition of “Person?”
Any entity with legal rights including:
Individuals (natural persons)
Corporations (legal person)
What is “Preemption?”
A superior government’s ability to have its laws supersede those of an inferior government
What is a “Private Right of Action?”
The ability of an individual harmed by a violation of a law to file a lawsuit against the violator
What are the roles and responsibilities of the Federal Trade Commission (FTC)?
General Authority to enforce rules against unfair and deceptive trade practices (including the power to bring deception enforcement actions where an organization has broken a privacy promise)
Statutory Responsibility for issues such as children’s online privacy and commercial email marketing.
Instrumental in developing U.S. privacy standards.
What are the roles and responsibilities of the Federal Communications Commission (FCC)?
Places significant compliance regulations on and governs the communications industry, such as television, radio, and telemarketing, and more recently, with online marketing developing such laws as the Telemarketing Sales Rule and Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM Act).
Along with the FTC, the FCC also enforces privacy laws.
What are the roles and responsibilities of the Department of Commerce (DoC)?
Leading role in federal privacy policy development
Administers the Privacy Shield Framework between the United States and the EU.
The DOC works along with the FTC on the enforcement of privacy and security standards set by organizations, particularly with those having privacy self-regulatory programs.
What are the roles and responsibilities of the Department of Health & Human Services (HHS)?
Creates regulations to protect the privacy and security of healthcare information.
Responsible for enforcing HIPAA laws.
The HHS shares rule-making and enforcement power with the FTC for data breaches related to medical records under the Health Information Technology for Economic and Clinical Health (HITECH) Act.
What are the roles and responsibilities of the two agencies responsible for regulating the Banking Industry?
Federal Reserve Board
Responsible for enforcing provisions of specific federal financial regulatory mandates, such as the Gramm-Leach-Biley Act (or GLBA).
Consumer Financial Protection Bureau An independent bureau under the Federal Reserve, has rule-making authority for laws related to financial privacy and oversees the relationship between consumers and financial product and service providers
Office of the Comptroller of the Currency (OCC)
Independent bureau of the U.S. Department of Treasury.
Regulates and supervises all national and federal banks and savings institutions, including agencies of foreign banks.
Ensures fair access to financial services and compliance with financial privacy laws and regulations.
What are the roles and responsibilities of the State Attorney Generals?
Chief legal advisor to the state government
State’s chief law enforcement officer. They may take enforcement action on a state’s unfair and deceptive practice law, HIPAA, GLBA, the Telemarketing Sales Rule and violations of breach notification laws
What are Self- Regulatory Programs?
Organizations monitor privacy through internal privacy practices, frameworks/guidelines, policies and procedures created and monitored by industry groups.
Government agencies, such as the FTC, may be involved in enforcement and adjudication
What are Trust Marks?
Images or logos of third party seal and certification programs that are displayed on websites to indicate that a business is a member of a professional organization or to show that it has adopted the guidelines of a program and passed a security and privacy test.
Designed to give customers confidence that they can safely engage in e-commerce transactions.
Examples include TrustArc, Norton, the Better Business Bureau, and EU-U.S. Privacy Shield
What is Criminal Liability?
Court proceedings for criminal prosecution
Initiated by: Government
Burden of Proof: Beyond a Reasonable Doubt
Remedy: Fines, restitution, incarceration or death
Sources of Law: Constitutions, laws and regulations
What is Civil Liability?
Disputes between individuals or organizations
Plaintiff (Private Party or Government) sues a Defendant to address a wrong
Burden of Proof: Preponderance of evidence
Remedy: Monetary Compensation or Injunctions
What is Administrative Enforcement?
Adjudication by an agency Initiated by Agency (e.g., FTC) Burden of Proof: Burden of Persuasion Remedy: Actions and Fines Sources of Law: Statutes that create agency governance
What is a Consent Decree?
An Agreement between the Government Agency and offending party requiring the offending party to do a specific actions and/or pay a fine.
Privacy Enforcement
What are the sources of law for legal liability in civil litigation?
Tort
Contract
Common law
What is a Tort?
A tort is a civil wrong recognized by law as having the grounds for lawsuits.
The primary goal for the lawsuit is to provide relief for damages incurred and deter others from committing the same wrongs.
What are the three general categories of a Tort and a description of each?
Intentional
Defendant knew or should have known that their action or inaction would cause harm
Negligent
Absence of failure to exercise proper or ordinary care. Defendant’s actions are unreasonably careless or unsafe.
Strict Liability
Defendant has legal responsibility for damages or injury even if they are not negligent or at fault (e.g. product liability)
What are other categories of legal liability (stemming from obligations under the law) and their descriptions other than a tort?
Breach of Warranty
Failure of a seller to fulfill the terms of a promise, claim or representation
Misrepresentation
False statements about a particular product or service
Defamation
Untruth about another that will harm the reputation of the person or organization defamed by libel (written defamation) or slander (oral defamation)
Statutory Actions
What federal agencies (other than those previously discussed) are responsible for enforcing or providing guidance on privacy laws and regulations?
Department of Homeland Security::
E-Verify Program
Rules for air traveler records (TSA)
Immigration and other border issues (Immigration and Customs Enforcement)
State Department::
Negotiates internationally with other countries on privacy issues and in multinational groups
Office for Civil Rights (HHS)::
Role in enforcing HIPAA rules
Department of Transportation::
Transportation Companies
Drones (FAA)
Internet-connected cars (National Highway Traffic Safety Administration)
Internal Revenue Service::
Privacy rules concerning tax records
Office of Management and Budget::
Interpretation of the Privacy Act of 1974
Guidance to federal agencies and their contractors
How do states enforce privacy laws and regulations?
State Attorney Generals
enforce laws/statutes and
unfair and deceptive practices (e.g., inadequate data protection and security capabilities)
What supports cross-border enforcement?
Cooperation between enforcement agencies, organizations and governments in more than one country/jurisdiction
OECD (Organization for Economic Cooperation and Development) - in 2007, adopted recommendations on cross-border cooperation in enforcement of laws protecting privacy
GPEN (Global Privacy Enforcement Network) – created in response to OECD recommendations. Aims to promote cross-border information sharing as well as investigation and enforcement cooperation among privacy authorities around the world.
APEC (Asia Pacific Economic Cooperation) CPEA (Cross Border Privacy Enforcement Arrangement) – share information and evidence in cross-border investigations and enforcement actions in the Asia-Pacific region.
The Constitution of the United States contains a preamble and _____ articles that describe the way the government is structured and how it operates.
seven
The first ten amendments to the Constitution are called
the Bill of Rights.
What is the data lifecycle?
Collection
Use
Disclosure
Destruction
What type of safeguards to protect privacy?
Administrative
Technical
Physical
What are the principles of privacy by design?
Proactive Privacy as default Privacy embedded into design Full functionality End to end security Transparency User centric
What are the four components of FIPS?
Rights of individuals
Information control
Lifecycle
Management
What are the four entires that data privacy offices deal with?
Customers/employees
Third parties
Laws
In house
What are the four privacy regulation models around the world?
Comprehensive
Sectorial
Co-regulatory
No protection
When did Europe legislate privacy protection?
Eu data protection directive of 1995
What are the 3 branches of government?
- Legislative Branch
- Executive Branch
- Judicial Branch
Who makes up the Legislative Branch? And what are its checks and balances?
a. Congress (House and Senate)
b. Congress confirms presidential appointees, can override vetos
Who makes up the Executive Branch? And what are its checks and balances?
a. President, VP, Cabinet, federal agencies
b. President appoints federal judges, can veto laws passed by Congress
Who makes up the Judicial Branch? And what are its checks and balances?
a. Federal Courts
b. Determines whether the laws are constitutional
What are the sources of U.S. law?
- Constitutions
- Legislation
- Regulations and Rules
- Case Law
- Common Law
- Contract Law
Is the right to privacy explicit in the U.S. Constitution.
No, the word “privacy” is not in the U.S. constitution. However, some parts directly affect privacy such as the 4th Amendment which limits government searches. State constitutions may create stronger rights than those found in the U.S. constitution. For example, CA state constitution expressly recognizes a right to privacy.
What is legislation?
Laws passed by Congress or state legislatures.
What are Regulations and Rules?
Compliance expectations placed on the marketplace by regulatory agencies. Some laws require regulatory agencies to issue regulations and rules.
What is Case Law?
Final decisions made by judges in court cases. When similar issues arise in the future, judges look to past decisions as precedent and decide the case in a manner consistent with past decisions - “stare decisis”
What is Common Law?
Legal principles that have developed over time in judicial decisions, often drawing on social customs and expectations.
What is a Consent Decree?
A judgment entered by consent of the parties whereby the defendant agrees to sop alleged illegal activity, typically without admitting guilt or wrongdoing. The legal document is approved by the judge and formalizes an agreement reached between a federal or state agency and an adverse party. The document describes the actions the defendant will take, and my be subject to a public comment period.
What is Contract Law?
It is a subcategory of Common Law.
What are the fundamental requirements for forming a binding contract?
- Offer
- Acceptance
- Consideration
What is an Offer?
Proposed language to enter into a bargain. It must be communicated to another person and remain open until it is accepted, rejected, retracted or has expired. A counteroffer ends the original offer.
What is Acceptance?
The assent or agreement by the receiver of the offer that the offer was accepted. Acceptance must be communicated to the offeror.
What is Consideration?
Is the bargain-for exchange. Legal benefit received by one person and the legal detriment imposed to the other. Consideration usually takes the form of money, property, or services.
What is Tort Law?
Are civil wrongs recognized by the law as the grounds for lawsuits. These wrongs result in an injury or harm that constitutes the basis for a claim.
What are the 3 general tort categories?
- Intentional Torts - wrongs that the defendant knew or should have known would occur through their actions or inactions.
- Negligent Torts - wrongs when the defendant’s actions were unreasonably unsafe.
- Strict Liability - wrongs that do not depend on the degree of carelessness by the defendant, but are established when a particular action causes damage.
What are examples of Privacy Torts?
intrusion upon seclusion, public revelation of private facts, casting a person in a false light, interfering with a person’s right to publicity, failing to provide adequate safeguards for PI
What is a Person?
Any entity with legal rights, including an individual or a corporation.
What is the meaning of Jurisdiction?
The authority of a court to hear a particular case. The court must have subject matter jurisdiction and personal jurisdiction.
What is Preemption?
A superior government’s ability to have its laws supersede those of an inferior government.
What is “Private Right of Action”?
The ability of an individual harmed by a violation of law to file a lawsuit against the violator.
What is Notice?
Is a description of the organization’s information management practices.
What is the purpose of a Notice?
- consumer education
2. corporate accountability
What does a typical Notice tell an individual?
- What information is collected
- How the information is used and disclosed
- How to exercise any choices about uses or disclosures
- Whether the individual can access or update the information
What is a Privacy Notice?
Often refers to external communications, issued to consumers, customers, or users.
What is a Privacy Policy?
Often refers to internal standards used within the organization.
What is Choice?
The ability to specify whether personal information will be collected and/or how it will be used or disclosed.
What is an “opt in” choice?
An affirmative indication of choice based on an express act of the person giving the consent.
What is an “opt out” choice?
A choice can be implied by the failure of the person to object to the use or disclosure.
What is Access?
The ability to view personal information held by an organization.
When must Access and Correction be provided?
When the information is used for any type of substantive decision making, such as for credit reports.
Which federal agencies engage in regulatory activities concerning privacy in the private sector?
- Federal Trade Commission (FTC)
- Federal Communications Commission (FCC)
- Department of Commerce (DoC)
- Department of Health and Human Service (HHS)
- Federal Reserve Board (Fed)
- Office of Comptroller of the Currency (OCC)
- Consumer Financial Protection Bureau (CFPB)
What privacy authority does the FTC have?
The general authority to enforce against “unfair and deceptive trade practices,” notably including the power to bring deception enforcement actions where a company has broken a privacy promise.
Who enforces privacy at the state level?
State attorney generals
How do state attorney generals bring enforcement actions?
Typically, pursuant to state laws prohibiting unfair and deceptive trade practices.
Who also plays a valuable role in governing privacy practices within industries?
Self regulatory regimes
What questions should be asked to understand any privacy related law, statute, or regulation?
- Who is covered by this law?
- What types of information (and what uses of information) are covered?
- What exactly is required or prohibited?
- Who enforces the law?
- What happens if I don’t comply?
- Why does this law exist?
What do the first 2 questions do?
Tell you the scope of the law.
What does the third question do?
Tells you what you need to know to comply with the law
What does questions 4 and 5 do?
They help you assess the risks associated with noncompliance or less than perfect compliance.
What does question 6 do?
Helps you understand the motivation behind the law.
What are the branches of government?
i. Legislative
ii. Executive
iii. Judicial
What is the legislative branch made up of and what are it’s checks and balances?
The legislative branch has the power to create new laws.
i. Congress (House of Representatives and the Senate)
ii. Confirms presidential appointees / can override vetos
How does a bill become a law?
1) The bill must pass both house and senate, then goes to the white house.
2) If the President signs the bill it becomes law, if not the President exercises their veto powers and goes back to the house.
3) The House must have a 2/3 majority to overturn a veto.
What is the executive branch made up of and what are its checks and balances?
The executive branch carries out and enforces existing laws
i. President, VP, Cabinet, Federal Agencies
ii. Appoint federal judges / can veto laws passed by congress
What is the judicial branch made up of and what are its checks and balances?
The judicial branch interprets the meaning of laws
i. Federal Courts
ii. Determines whether laws are constitutional
What are the sources of law?
i. Constitutions – Supreme law of the land. All other laws must be consistent. (Unconstitutional laws are declared invalid by courts). Amendments are difficult.
ii. Legislation – Laws passed by congress or state
iii. Regulations and rules – Compliance expectations set my regulatory agencies (“Administrative Law”)
iv. Case law – Final decisions made by judges in court cases and looked to as precedent
v. Common law – Legal principles that have been developed over time in judicial decisions – often drawing on social customs and expectations
vi. Contract law – A subcategory of common law (e.g., The Uniform Commercial Code (UCC) exists in all 50 states.)
Jurisdiction
Jurisdiction is the power that a court has to render legal judgments.
Jurisdiction may be limited by subject matter or geographic applicability.
Person
A person is a human or non-human entity that:
1) can sue and be sued,
2) can own property, and
3) can take part in contracts.
Preemption
A law that stems from a higher authority takes precedence over laws that stem from lower authorities.
Private Right of Action
Laws with a private right of action grant legal persons the ability to bring cases to court.
Department of Commerce (DoC)
Summary: Implemented the EU-US Privacy Shield before it was struck down
Detail: Leading role in federal privacy policy development. Administers the Privacy Shield Framework between the US and EU. The DoC works along with the FTC on the enforcement of privacy and security standards set by organizations, particular with those having privacy self-regulatory programs.
What does the Dept of the Treasury do?
The Department of the Treasury manages Federal finances by collecting taxes and paying bills and by managing currency, government accounts and public debt. The Department of the Treasury also enforces finance and tax laws.
Is Dept of Treasury the IRS?
The IRS is a bureau of the Department of the Treasury and one of the world’s most efficient tax administrators. In fiscal year 2020, the IRS collected almost $3.5 trillion in revenue and processed more than 240 million tax returns.
What is the difference between IRS and Treasury?
The Department of the Treasury is responsible for the money, printing, destroying old unusable money. The IRS collects all tax revenue for the Federal Government.
Taxpayer Bill of Rights 7: The Right to Privacy
The Taxpayer Bill of Rights (TBOR) is a cornerstone document that highlights the 10 fundamental rights taxpayers have when dealing with the Internal Revenue Service (IRS).
