Chapter 2

Question 1

Consent Decree

Answer 1

A consent decree is a judgment entered by consent of the parties whereby the defendant agrees to stop alleged illegal activity, typically without admitting guilt or wrongdoing.

This legal document is approved by a judge and formalizes an agreement reached between a federal or state agency and an adverse party.

The consent decree describes the actions the defendant will take, and the decree itself may be subject to a public comment period.

Once approved, the consent decree has the effect of a court decision.

Question 2

Privacy Notice

Answer 2

In cert-speak, this is publicly facing privacy terms (whereas “privacy policy” refers to internal rules regarding how data privacy handled.

Notice is a description of an organization’s information management practices.

Notices have two purposes: (1) consumer education and (2) corporate accountability.

The typical notice tells the individual what information is collected, how the information is used and disclosed, how to exercise any choices about uses or disclosures, and whether the individual can access or update the information.

Question 3

U.S. Dept. of Commerce

Answer 3

The U.S. Department of Commerce does not have regulatory authority for privacy, but often plays a leading role in privacy policy for the executive branch.

Question 4

California Data Breach Law (as example) - SB 1386

Answer 4

1. Who covered? Natural persons, legal persons and govt. agencies doing business in CA.
2. What is covered? Name in combo with SSN, CA ID card, driver’s license number, or financial account, credit or debit card number plus code to access.
3. What is required or prohibited?

This law requires all persons to disclose any breach of system security to any resident of California whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person.

4. Who enforces the law? CA Attorney General, and PROA.
5. Consequences of noncompliance? Damages and force compliance.
6. Why does this law exist? Because security breaches of computerized databases are feared to cause identity theft—and individuals should be notified about these breaches so they can take steps to protect themselves