Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

US PRIV > Chapter One: Intro to Privacy > Flashcards

Chapter One: Intro to Privacy Flashcards

You may prefer our related Brainscape-certified flashcards:
U.S. Geography flashcards
1
Q

The 3 Main PRIV focuses are…

A

1.) Collection
2.) Use
3.) Transparency …. of PII

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Algorithmic Transparency is..

A

Consideration for whether AI has good inputs to make sound calculation, and the degree of bias involved.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

4 Classes of PRIV are…

A

1.) Information Privacy
2.) Bodily Privacy
3.) Territorial Privacy
4.) Communications Privacy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Information Privacy

A

Governing the collection and maintenance of PII.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Bodily Privacy

A

To not invade a person’s physical being.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Territorial Privacy

A

Monitoring and environment to prevent intrusion.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Communications Privacy

A

Protecting correspondence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

3rd Amendment (U.S. Constitution)

A

Bans the forced quartering of soldiers in private homes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

4th Amendment (U.S. Constitution)

A

Requires law enforcement warrants for searches of private property.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

5th Amendment (U.S. Constitution)

A

Not required to testify against self.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

California Constitution, Article 1, Section 1 (1974)

A

Codifies right to acquire and protect private properties, and maintain privacy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

United Nations “Universal Declaration of Human Rights” (1948)

A

No arbitrary interference with privacy, family, home, and correspondence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

European Convention for the Protection of Human Rights and Fundamental Freedoms, Article 8 (1950)

A

Declares universal right to private life, family, home, correspondence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Fair Information Practices (FIPs)

A

Standards for organizing the multiple individual rights and organization responsibilities with respect to privacy.

Vary by region, open to interpretation, not always legally binding.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Four Main FIPs Categories

A

1.) Rights of Individuals
2.) Controls on Information
3.) Information Life Cycle
4.) Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Rights of Individual (Four Main FIPs Categories)

A

Components:
1.) Notice
2.) Choice and Consent
3.) Data subject access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Notice (Rights of Individuals/FIPs)

A

Supply a privacy policy, disclosing purpose, use, and retention for PII.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Choice and Consent (Rights of Individuals/FIPs)

A

Consent can be implicit or explicit.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Data Subject Access (Rights of Individuals/FIPs)

A

Data subject should have access to review and update PII.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Controls on Information (Four Main FIPs Categories)

A

Components:
1.) Information Security
2.) Information Quality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Information Security (Controls on Info/FIPs)

A

Data Controller must implement admin, technical, and physical safeguards.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Information Quality (Controls on Info/FIPs)

A

Data collection must be accurate, complete, and relevant to the stated intent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Information Life Cycle (Four Main FIPs Categories)

A

Components:
1.) Collection
2.) Use and Retention
3.) Disclosure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Data Collection (Info Life Cycle/FIPs)

A

Data should be collected only for the specified purpose.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Data Use and Retention (Info Life Cycle/FIPs)

A

Limit data use to what is in the privacy notice and has been consented to.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Data Disclosure (Info Life Cycle/FIPs)

A

Limit data disclosure to purposes specified and consented to.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Management (Four Main FIPs Categories)

A

Define
Document
Communicate
Assign

…accountability to PRIV processes and procedures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

U.S. Health Education and Welfare FIPs (1973)

A

. Existence of the record set should be disclosed.

. Allow data subject access. Can contest inappropriate use, request correction.

. Data must be reliable and well protected.

29
Q

FIPs: OECD Guidelines (1980/2013)

A

. Is the most widely used FIPs framework (FTC endorsed)

1.) Collection Limitation Principle
2.) Data Quality Principle
3.) Purpose Specification Principle
4.) Use Limitation Principle
5.) Data Security Principle
6.) Openness Principle
7.) Individual Participation Principle
8.) Accountability Principle

30
Q

Collection Limitation Principle (OECD)

A

Collection must be lawful, fair, limited, consented to.

31
Q

Data Quality Principle (OECD)

A

Data must be accurate, complete, and relevant.

32
Q

Purpose Specification Principle (OECD)

A

Purpose of data should be specified no later than time of collection.

Uses outside of original should be “compatible” and “publicized.”

33
Q

Use Limitation Principle (OECD)

A

Don’t deviate from specified use.

Two exceptions: (1) Data subject consent, (2) legal authority.

34
Q

Data Security Principle (OECD)

A

Implement protection against unauthorized access and destruction.

35
Q

Openness Principle (OECD)

A

Maintain a general policy of openness about development, practices, and policies regarding PII.

Establish the existence of PII and ID the Data Controller.

36
Q

Individual Participation Principle (OECD)

A

Data subject retains right to retrieve data in an affordable and timely manner.

Denial of retrieval must be be justified and can be appealed.

Data subject can challenge to amend or erase data.

37
Q

Accountability Principle (OECD)

A

Data controllers should be accountable for complying with PRIV measures.

38
Q

FIPs: Council of Europe Convention (1981)

A

Applies to member states and allows free trans-border data flow within.

Is more less the same as OECD.

Race, political affiliation, religion, health, sex life, criminal history data cannot be collected unless protected in each country’s domestic law.

39
Q

FIPs: APEC Privacy Framework (2004)

A

Includes 21 Asia Pacific members + the Americas.

Is not legally binding.

Generally mirrors OECD but is more explicit about exceptions:
(1) w/ subject consent
(2) when necessary to provide product or service requested by subject
(3) authority of law

40
Q

FIPs: Madrid Resolution (2009)

A

The primary goal is to set principles and rights guaranteeing:
(1) Effective and internationally uniform protection of PII.
(2) Facilitation of international flows of PII.

41
Q

Proportionality Principle (Madrid Resolution)

A

Processing of PII should be limited, relevant, adequate, and not excessive in relation to stated purposes.

42
Q

The first known data law was enacted in…

A

Hesse, Germany (1970)

43
Q

Personally Identifiable Information (PII)

A

Information that makes it possible to ID an individual. Is covered by PRIV law. (U.S. definition)

44
Q

Sensitive Personally Identifiable Information (SPII)

A

A highly sensitive subset of PII that varies depending on jurisdiction and regulations:
- SSNs
- Financial Info
- Drivers License
- Health Records
- etc.

45
Q

Non-Personal Information is sometimes called…

A

De-identified, anonymized, or pseudonymized.

46
Q

Personal vs. Non-Personal Information…

A

are not always clearly distinct.

Ex.) IP Addresses are protected in the EU but not in the US 1974 Privacy Act.

47
Q

Public Records

A

Info collected and maintained by a government entity and made available to the public.

Related-laws vary by jurisdiction.

ex.) real-estate records

48
Q

Publicly Available Info

A

ex.) phone book info and search engine results

49
Q

Non-Public Information

A

Data is not generally available or easily accessed due to law or custom.

ex.) medical records, financial records, adoption records

50
Q

Processing

A

Collection, recording, maintenance, retrieval, consultation, transmission, destruction of PII.

51
Q

Data Subject

A

The person about whom the information is being processed.

52
Q

Data Controller

A

The organization with the authority to decide how and why PII is to be processed.Can be an individual, or an org legally treated as such.

53
Q

Data Processor

A

An individual or org, often 3rd party, that processes data on behalf of the Data controller.

54
Q

Sources of Privacy Protection

A

1.) Markets (i.e. consumer demand)

2.) Technological advancement (e.g. encryption software)

3.) Law (this is the traditional approach)

4.) Self and Co-Regulation

55
Q

Three Components of Self and Co- Regulation

A

1.) Legislation
2.) Enforcement
3.) Adjudication

56
Q

Legislation (Self and Co- Regulation)

A

Who defines privacy rules?

ex.) A company policy or industry association.

57
Q

Enforcement (Self and Co- Regulation)

A

Who should initiate enforcement action?

ex.) Data Protection Authorities (DPAs,) Gov’t Agencies, industry Code Enforcement, Affected Individuals

58
Q

Adjudication

A

Who should decide whether an org has violated a PRIV rule?

ex. Industry Association, Gov’t Agency, Judicial Officer

59
Q

Comprehensive Model

A

Those in which the gov’t has defined requirements throughout the economy.

No existing regime is so comprehensive all laws are written, enforced, and adjudicated by the gov’t.

ex.) DPAs in Europe

60
Q

Sectoral Model

A

When PRIV laws exist in specific market segments. This is the US standard.

61
Q

Reasons countries will create comprehensive laws include…

A
  • Remedy past injustices
  • Be consistent with GDRP
  • Promote e-commerce
62
Q

Critiques of Comprehensive Model

A
  • Regulations too costly
  • One-size-fits-all approach may not be proportional to risk
  • May not allow room for innovation in data processing
63
Q

Critiques of Sectoral Approach

A
  • Lack on central oversight
  • Inadequate execution of protections
  • Legislation may lag innovation
  • Industry pushback
64
Q

Co- Regulatory Model

A

The development of industry standards for PRIV against the backdrop of gov’t legal reqs.

Is standard in Australia.

Can exist under comprehensive AND sectorial models.

65
Q

U.S. Children’s Online Protection Act (COPPA)

A

Allows compliance with industry codes to satisfy PRIV statute if the code is FTC approved.

66
Q

Self Regulatory Model

A

The creation of codes of practice for the protection of PII by a company or industry.

May NOT have a legal framework.

67
Q

Seal Program

A

A form of self-regulation that requires its participants to abide by codes of information practices and some variation of monitoring compliance.

In the US, the FTC can give a seal program authority (like for COPPA).

68
Q

Technology Based Model

A

These reduce the need for administrative measures.

ex.) end-to-end encryption

US PRIV (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions