Chapter 1 - Intro to Privacy Flashcards

Question

OECD - Purpose Specification Principle

Answer 1

Purposes for which personal data are collected should be specified not later than at the time of the data collection and the subsequent use limited to the fulfillment of those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of change of purpose

Answer 2

Personal data should not be disclosed, made available or otherwise used for purposes other than those specified in accordance with the Purpose Specification Principle except (i) with the consent of the data subject or (b) by the authority of law

Answer 3

Personal data should be protected by reasonable security safeguards against such risks as loss or unauthorized access, destruction, use, modification or disclosure of data.

Answer 4

There should be a general policy of openness about developments, practices and policies with respect to personal data. Means should be readily available of establishing the existence and nature of personal data, and the main purposes of their use, as well as the identity and usual residence of the data controller

Answer 5

An individual should have the right: (i) to obtain confirmation of whether or not the data controller has data relating to them (ii) to have communicated to him, data relating to him, within a reasonable time, at a charge, if any, that is not excessive, in a reasonable manner, and in a form that is readily intelligible to him (iii) to be given reasons if a request made under the preceding clauses is denied, and to be able to challenge such denial (iv) to challenge data relating to him and if the challenge is successful, to have the data erased, rectified, completed or amended

Answer 6

A data controller should be accountable for complying with measures which give effect to the OECD principles.

Answer 7

information that makes it possible to identify and individual (i.e., social security numbers, passport numbers, street address, telephone number, email address)

Answer 8

Data where element used to identify the individual are removed and the remaining data becomes nonpersonal info.

Answer 9

Data where info about individuals is retained under pseudonymns, such as a unique numerical doce for each person, that renders data temporarily nonpersonal. Pseudonmyized data can be reversed.

Answer 10

The line between these 2 categories is not always clear, and regulators and courts in different jurisdictions may disagree on what counts as personal information. For example, IP addresses dont constitute personal information under the Privacy Act, , but the FTC has stated that in the context of breaches of healthcare information, IP addresses ARE personal information.

Answer 11

1 - financial data 2- operational data 3- intellectual property 4- info about the org's products and services

Answer 12

the collection, recording, organization, storage, updating or modification, retrieval, consultation and use of personal information; it also includes disclosure by transmission, dissemination or making available in any other form, linking, alignment, or combination, blocking, erasure, or destruction of personal information.

Answer 13

Information may be public record, publicly, available, and nonpublic all at once, and to understand how to use the underlying information, one must understand the source that provided the information (i.e., restrictions may apply to use of the name and address in a patient file, but not to public records or publicly available information)

Answer 14

an org that has the authority to decide how and why personal info is to be processed.

Answer 15

a 3rd party outsourcing services, that processes data on behalf of the data controller. Data processors arent authorized to do additional data processing outside of the scope of what is permitted for the data controller itself. Under HIPPA, data processors are called "business associates".