Chapter 1 Flashcards
What are the 4 goals of a privacy manager?
1) Identify privacy obligations for the organization
2) Identify business, employee and customer privacy risks
3) Identify existing documentation, policy and procedures
4) Create, review and implement policies and procedures that effect positive practices and together comprise a privacy program
The five goals of a privacy program are to:
1) Promote consumer trust and confidence
2) Enhance the organization’s reputation
3) Facilitate privacy program awareness, where relevant, of employees, customers, partners and service providers
4) Respond effectively to privacy breaches
5) Continually monitor, maintain and improve the privacy program
What is accountability?
Accountable organizations have the proper policies and procedures to promote proper handling of personal information and, generally, can demonstrate that they have the capacity to comply with applicable privacy laws
They promote trust and confidence and make all parties aware of the importance of proper handling of personal information.
Ownership is traceable
How can accountability benefit organizations?
Accountability as defined by laws can actually benefit organizations because in exchange it can give organizations a degree of flexibility about how exactly they will comply with their obligations
How does privacy enhance an organization’s brand? 3
1) Meets regulatory compliance obligations
2) Reduces the risk of a data breach
3) Meets expectations of a client
What are the activities supporting a privacy program that might be carried out by different functions in an organization 5
1) Adoption of privacy policies and procedures
2) Development of privacy training and communications
3) Deployment of privacy and security enhancing controls
4) Contract develop and management of third parties who process the personal info of the organization
5) Assessment of compliance with regulations
As a rule privacy policies and procedures are created at an enterprise of functional level
At a functional level
In a function, which group typically is responsible for security enhancing tools like encryption, data parameter security controls and data loss preventions?
Information security
What are the five components of a privacy program
1) Privacy vision and mission statement
2) Scope of the privacy program
3) Appropriate privacy framework
4) Organizational privacy strategy
5) A privacy team
What are the two steps to identifying the scope of a privacy program?
Identify the personal information collected and processed
Identify in scope privacy and data protection laws and regulations
What are the considerations when identifying collected data? 7
Who collects data
What type of information are collected a
Where is the data stored physically
When is data collected
Why do we collect the data?
How long is the data retained and how is it deleted?
What security controls are in place to collect the data?
What is considered a general best practice when dealing with countries with different privacy regulations?
Choose the most restrictive of the two policies
What is PCI DSS
Payment Card Industry Data Security Standard - a global industry standard that is not a law but imposes data protection requirements on institutions and notification requirements
What are the three groupings of privacy frameworks
1) Principles and Standards ex. GAAP
2) Laws, Regulations & Standards ex. HIPAA
3) Privacy Program Management Solutions e.g. ex. privacy by design
What are the three considerations when deciding to adopt the strictest standard of privacy
Violate other data privacy laws
Budgetary concerns
Contradict organizational goals and objectives
What are the things that a privacy tech vendor might manage 6
1) Assessment
2) Consent
3) Data mapping
4) Incident response
5) Privacy information
6) Website scanning/compliance
What are the services provided by an external enterprise program management service 4
1) Activity monitoring
2) Data discovery
3) De-identification/pseudonymization
4) Enterprise communications
What does GRC stand for?
Governance Risk Compliance, generally in the context of a tool
What does a GRC tool usually used for? 3
Governance Risk Compliance tools generally:
1) Create and distribute policies and controls and map them to regulations and internal compliance requirements
2) Asses whether controls are in place and working and fix them if not
3) Ease risk assessment and mitigation
What is a privacy strategy?
An organization’s approach to communicating and obtaining support for a privacy program.
Describe a centralized governance model
Leaves one person or team responsible for all privacy related affairs
Works best in single-channel functions were data flows in one direction
Advantages: efficient
Disadvantages: requires many permissions
Describe a local or decentralized governance model
Decisionmaking is delegated down
Less rigid and more spans of control
Advantages: decisions are made by those who understand their function
Disadvantages: roles are repeated
Describe a hybrid governance model
Typically one department has responsibilities for privacy-related affairs, issuing policies, directives, and core values
Local entities fulfill responsibilities
Each region might have a privacy manager
What does DPO mean
Data Privacy Officer is the designated individual accountable for an organization’s privacy compliance, often required by data privacy regulations
The DPO must report to the highest level of controller and possess expert knowledge of data protection law and practices
What are the reasons why a DPO might be required? 3
1) By public, authorities or bodies
2) When the business’s core activities require processing of data which require regular and systematic monitoring on a large scale
3) When the organization’s core activities consist of processing special categories of data at a large scale
What are common elements of a global law or regulation? 6
Notice Choice and consent Purpose limitations Individual rights Data retention limits Data Rights
What are the categories of privacy laws? 10
General privacy laws - apply to whole country
Federal privacy laws - entire country but to a specific sector
State/province laws (e.g. GLBA; HIPAA, COPPA)
Health
Financial
Online
Communication
Information
Education
Privacy in one’s home
What does GDPR stand for?
General Data Privacy Regulation is a framework for data protection with increased accountability for organizations. It is rapidly becoming the global standard for data privacy protection.
To whom does GDPR apply?
Personal data of those in the EU regardless of location of data processing related to the offering of goods and services, monitoring of their behavior as far as the behavior occurs in the EU.
Under GDPR what are the 5 things consumers can do?
1) Withdraw consent for processing
2) Request a copy of their data
3) Request to move their data to different location in a machine readable format
4) Request you delete data
5) Object to automated decisionmaking processes includig profiling
What 4 things can regulators do under GDPR?
1) Ask for records of processing activities and proof of compliance
2) Impose temporary data processing bans, require data breach notifications or order erasure of personal data
3) Suspend cross-border data flows
4) Enforce penalties up to 20M Euro or 4% of annual revenue for noncompliance
When can data be transferred to another country?
Unless transfer of the data is specifically banned by low it can be transferred to a country with roughly similar privacy protections
In what form might a privacy framework take? 4
Resuable structures
Checklists
Templates
Processes & Procedures
What is the data usage lifecycle? 5
Collection Usage Transfers Retention Destruction
What is the process called where the data inventory or data map is compared to applicable laws and regulations?
Gap analysis
What is the best way to maintain a record of processing activities?
Maintain a data flow analysis report identifying the different categories of personal data, purposes for which data is processed, the recipients and the way data flows around the business as well as externally
The data flow analysis should only contain personal data (T/F)
False, non-personal data should be collected as implementing a new process means revised or new apps systems must thoroughly document the personal data they are processing
When data processing activities should be included in a data inventory or data map? 5
Security used to protect data Retention periods for data Who has access to the data Who the data is disclosed to The legal basis for processing it
What are the 3 types of assessments and impact assessments?
privacy assessments
PIAs
DPIA
What is a Privacy Assessment
Privacy assessments measure an organization’s compliance with laws, regulations, adopted standards and internal policies and procedures.
What is the scope of a privacy assessment? 8
Education & awareness Monitoring and responding to the regulatory environment Data, systems and process assessments Risk assessments Incidence response Contracts Remediation Program assurance
What is a PIA?
A privacy impact assessment is an analysis of risk associated with processing personal information in relation to a project, product or service
It is a risk management tool used to identify the privacy/data protection risks to individuals and organizations.
What is privacy by design?
Privacy by design is the concept of building privacy directly into technology, systems and practices at the design phase. It helps ensure privacy is considered from the outset.
When should an organization conduct a PIA? 3
Prior to the development of a project, product, or service that requires the collection of PII
When there are new or revised industry standards, organizational policies, or laws and regulations
When the organization creates new privacy risks through changes in the way PII is handled
What tools might an organization use to prioritize PIAs?
A PIA express tool or a Privacy Threshold Analysis (PTA)
What are the 5 phases of a PIA
1) Identifying flows of PII
2) Analyzing the implications of the use case
3) Determining the relevant privacy safeguarding requirements
4) Assessing privacy risk
5) ) Preparig to treat privacy risk by choosing the privacy treatment, controls
What is a DPIA?
A Data Protection Impact Assessment describes a process designed to identify risks arising out of the processing of personal data and to minimize those risks as much and as early as possible. A DPIA may be mandated by GDPR with fines assessed for failing to comply.
When is a DPIA required
In cases where the processing is “likely to result in a high risk to the rights and freedoms of natural persons” the controller shall, prior to processing, carry out a DPIA. Risks include profiling that might lead to legal outcomes criminal, legal or health data of individuals, on a very large scale, data matching, analysis on vulnerable populations, or use of a new technology.
What should a DPIA include (3)
Per the GDPR a Data Protection Impact Assessment should include:
1) A description of the processing including its purpose and the interest being pursued
2) The necessity of the processing, its proportionalit and the risks it poses to its data subjects
3) Measures to address the risks identirfied
