Chapter 4 - Privacy Operational Lifecycle: Assess: Data Assessments Flashcards
What is the Data Management Association (DAMA) International definition of Data Governance
Planning, oversight and control over management of data and the use of data and data related sources
What are the ten spokes of the data management wheel according to DAMA
1 architecture
2 modelling and design
3 storage and operations
4 security
5 integration and interoperability
6 documents and content
7 reference and master data
8 warehousing and BI
9 metadata
10 quality
What are common organisational data governance roles
Strategic - Steering committee / c-level: steers and approves strategy, governance and policies.
Managerial - functional owners responsible for data assets. Responsible for delivering requirements.
Operational - stewards and day to day accountability.
What are the elements of a data inventory
- The nature of the data repository
- The owner of the repository
- The legal entity of the processing
- Volume of information in the repository
- Format of the information
- The use of the information
- Data retention
- Types of data (e.g. email, ids)
- Location of storage
- Where is data accessed
- International transfers
- With whom is data shared
- Transfer mechanisms
Does the ROPA requirements under Article 30 apply to controllers or processors?
Both
When is a ROPA not required?
If less than 250 persons, processing is occasional, does not include sensitive personal information and is not likely to result in a risk to the rights and freedoms of individuals.
What are the three types of assessments?
- Privacy assessments
- Privacy impact assessments
- Data privacy impact assessments
Name on time a PIA is required by the US Government under the E-Gov Act of 2002
When developing or procuring IT systems that process PII of the public or when initiating an electronic collection of PII
Name the ISO standard involved in determining a PIA
ISO 29134 which is a set of guidelines (not standards) for how to do conduct a PIA including the 4 steps of a PIA
- Threshold determination if PIA needed
- Preparing a PIA
- Performing a PIA
- Following up on a PIA
When is a DPIA required?
Under GDPR a DPIA is required when the processing is likely to result in high risk to individuals.
What examples does article 35(3) of GDPR give for when a DPIA is required
- Profiling
- Large scale processing
- Systematic processing on a large scale
What are the Article 29 Working Party Guidelines for when a DPIA is required?
- Evaluation or scoring
- ADM
- Systemic monitoring
- Sensitive data
- Large scale processing
- Matching or combining data sets
- Vulnerable data subjects
- New technology / new uses
- When processing restricts ability to exercise rights
What are the three key aspects of Information Security
Confidentiality
Integrity
Availability
What are information security controls designed to achieve
Prevent, detect or correct a security incident
What are the three types of information security controls?
Physical controls, administrative controls and technical controls
What are factors to consider for ensuring proper physical information security
- Quality of locks on document storage facilities
- Access control to premises
- Protection against man made and natural threats
- Disposal of physical and electronic files
- Methods for keeping IT assets secure
What are the three ways that NIST 800 recommends for removing data from hardware devices
Clearing, purging or destroying
What are the factors to consider when assessing vendors?
- reputation
- Financial condition and insurance
- IS controls / certifications
- Transfer mechanism with vendor
- Disposal of information
- Employee training and awareness
- Vendor incident response
- Audit rights
- Policies and procedures
- DPOs
What are the three cloud computing models
IaaS - user responsible for software and applications
PaaS - user responsible for applications
SaaS - provider does all
What factors should you consider when assessing a cloud service provider?
- Certifications and standard
- Technologies
- Service road map - how to stay up to date
- Data management - how is data stored accessed and managed
- Information security - auditable controls
- Sub processors
What does Article 28 of GDPR require controllers to satisfy themselves of prior to appointing a processor?
processors who can provide “sufficient guarantees” about the implementation of appropriate technical and organizational measures for compliance with the GDPR and the protection of the rights of data subjects.
What must a business do to shift liability to a vendor under the CCPA?
Ensure written contracts in place limiting the processing of the vendor to the business purpose of the contract. Attestations of compliance also required.
Will a vendor always be considered a third party under the CCPA?
Not necessarily, however if a vendor uses personal information for its own purposes then it may be considered a third party and data subjects may have the right to receive written notice of such disclosees.
