Chapter 3: Regulatory Enforcement

Question 1

Agency that handles unfair and deceptive trade practices

Answer 1

FTC

Question 2

Consent decree

Answer 2

Formal agreement between the government and a company on how they will behave

Question 3

FTC complaint process

Answer 3

Investigation
Complaint
Resolution or Administrative Law court appeal
Federal court appeal

Question 4

Factors in determining unfair practices

Answer 4

Injures consumer
Violates public policy
Unethical or unscrupulous

Question 5

Criteria for determining unfair practices

Answer 5

Substantial injury
Injury not outweighed by benefits
Injury must not be reasonably avoidable by consumers

Question 6

FTC vs. Wyndham Worldwide

Answer 6

Did not live up to their privacy policy with the security investments

Question 7

FTC vs. LabMD

Answer 7

2016
Inufficient cybersecurity practices

Question 8

FTC vs. LifeLock

Answer 8

2010
Deceptive advertising
Also must implement stronger security controls

Question 9

First LifeLock fine

Answer 9

$12 million

Question 10

Second Lifelock fine

Answer 10

2019
$100 Million

Question 11

FTC vs. DesignerWare

Answer 11

2012
Spyware and keystroke logger
Order to stop doing this

Question 12

Deceptive practices

Answer 12

Likely to mislead consumers
Perspective of reasonable consumer(s)
Pracrice is material

Question 13

Geocities deceptive practices

Answer 13

Sold customer info after saying they wouldn’t

Question 14

Eli Lilly deceptive practices

Answer 14

Collected patient info and then sent patient identities to all other patients

Question 15

Nomi deceptive practices

Answer 15

Used sensors to track customers mobile devices without their consent

Question 16

Snapchat deceptive practices

Answer 16

Told customers that messages and pictures disappeared forever but knew there were workarounds

Question 17

TRUSTe deceptive practices

Answer 17

Provides certifications of privacy practices. Failed to perform annual recerts.

Question 18

Facebook 2012 deceptive practices

Answer 18

Shared information about “friends” with 3rd party developers

Question 19

Facebook 2019 fine

Answer 19

$5 billion

Question 20

Zoom deceptive practices

Answer 20

Said they had end to end encryption, but they didn’t.

Question 21

FCC

Answer 21

Responsible for communications

Question 22

CPNI

Answer 22

Consumer Proprietary Network Information

Question 23

2014 Verizon FCC enforcement

Answer 23

Used CPNI for marketing without consent
$7.4 Million settlement

Question 24

TerraComm and YourTel America FCC enforcement

Answer 24

Posted customer info on a public website

Question 25

Department of Commerce

Answer 25

Handles international privacy agreements

Question 26

HHS

Answer 26

Implements HIPAA

Question 27

HHS Lifespan case

Answer 27

$1 million fine for stolen unencrypted laptop with PHI

Question 28

HHS Jackson Health Systems fine

Answer 28

$2 million for multiple incidents with lost, sold, and leaked patient info

Question 29

HHS case against a doctor

Answer 29

$100,000 for violating HIPAA security rule

Question 30

CFPB

Answer 30

Lead federal agency for consumer finnacial protection

Question 31

GST Factoring CFPB enforcement

Answer 31

$25,000 for illegal telemarketing

Question 32

Equifax CFPB fine

Answer 32

$575 million for losing records for 147M people

Question 33

Which agency enforces FERPA

Answer 33

Department of Education

Question 34

Self-regulation programs

Answer 34

Groups of companies enforce their own standards

Question 35

PCI DSS

Answer 35

Self-regulation Security and privacy

Question 36

NAI

Answer 36

Network Advertising Initiative Self-regulation focused on digital marketing

Question 37

NAI publishes...

Answer 37

A code of conduct

Question 38

NAI code of conduct contains

Answer 38

Privacy practices Opt-out mechanisms Security procedures

Question 39

Where does NAI refer violators?

Answer 39

FTC

Question 40

Trust marks

Answer 40

Symbols demonstrating independent 3rd party review of privacy standards

Question 41

Safe harbor agreements

Answer 41

Exempt from prosecution for certain laws if they meet requirements

Question 42

Privacy Shield

Answer 42

Between the US and EU allowing data transfers if firms comply with GDPR. Orgs must certify with Privacy Shield. Found illegal in 2020 with the Schrems II decision