Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

DP > Data Privacy > Flashcards

Data Privacy Flashcards

1
Q

How long after a valid request does an educational institution have to provide access to education records of a student?

A

A “reasonable” time, not to exceed 45 days.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

After a consumer disputes the accuracy of information in a consumer report, how long does a consumer reporting agency have to re-investigate the information?

A

30 days.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The California Consumer Privacy Act is an example of what type of privacy protection?

A

A comprehensive model.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How many days does an organization have to cure a violation of the CCPA before it may be subject to fines or a private cause of action?

A

30 days.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

All of the following are best practices in obtaining consumer consent, except:

A

Companies should obtain a separate consent specifically applicable to third-party data processors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Under which of the following pieces of legislation are data brokers required to comply with a one-stop mechanism that allows data subjects to request the deletion of their personal data?

A

California’s Delete Act.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

According to the Supreme Court’s decision in Société Nationale Industrielle Aerospaciale, all of the following should be considered in a comity analysis, except:

A

Whether the parties have domestic subsidiaries in the United States.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the most common phrase used in state-level data breach notification laws to describe when notice must be provided to affected individuals?

A

At the most expeditious time possible and without unreasonable delay.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the standard utilized by FISC to determine whether an application for a surveillance order should be granted?

A

Whether there is probable cause to believe that that the person being monitored is either a foreign power or an agent of a foreign power.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Who is responsible for enforcement under the Payment Card Industry Data Security Standard?

A

Individual payment card brands.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What change to the use of National Security Letters was implemented by the USA-PATRIOT Act?

A

An NSL may now be issued if relevant to an authorized investigation to protect against international terrorism or clandestine intelligence activities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

If a third party accidently accesses protected health information without authorization, which of the following is accurate?

A

A breach is presumed unless a risk assessment establishes that there was a low probability that PHI has been compromised.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

As defined under the Fair Credit Reporting Act, which of the following is least likely to be considered an “employment purpose” for which a consumer report may be obtained?

A

Determining whether an employee is entitled to a raise.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which of the following most accurately states whether a data processor experiencing a data breach must disclose to a data controller that a breach occurred under state-level breach notification laws?

A

Every state requires that a data processor notify a data controller when a breach occurs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

All of the following are benefits of data flow mapping, except:

A

It may limit the amount of data disclosed in the event of a data breach.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which of the following best describes the enforcement of CAN-SPAM at the federal level?

A

The FTC enforces CAN-SPAM according to its “unfair and deceptive” trade practices authority but shares enforcement authority with prudential regulators.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

In addition to “unfair” and “deceptive” trade practices, state UDAP laws also commonly prohibit what other type of act or practice?

A

“Unconscionable” acts or practices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which is the most accurate advice that Jackson can provide to BotVoice about its compliance obligations under HIPAA?

A

HIPAA does not apply because the health information provided by children is not made in connection with a covered transaction.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

CAN-SPAM-Act prohibits communication after how many days of opting out

A

more than 10 days

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

OP-Out Consent is

A

A passive form, where consent is implied, processing occurs unless you opt-out

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Information privacy focuses on what

A

Policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Information security focuses on what

A

Protection of data from unauthorized access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Privacy focuses on what type of data

A

Personal information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Security focuses on what type of information

A

Confidential information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

CIA triad stands for what

A

Confidentiality, Integrity, Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Security controls do what

A

Limit damage, loss, modification, and unauthorized access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Purposes of seurity controls

A

Preventative, Detective, Corrective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Preventive controls

A

Prevent an incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Detective controls

A

Identify an incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Corrective controls

A

Fix or limit the damage of an incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Types of controls

A

Physical, Administrative, Technical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

OMB 7 step breach response

A
  1. Breach response team. 2. Privacy docs. 3. Sharing breach information. 4. Reporting. 5. Assess the risk. 6. Mitigating risk. 7. Notification.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

FTC 4 step breach response

A

Confirm the breach. Then, 1. Secure Operations / Contain. 2. Analyze and fix vulnerabilities. 3. Notify. 4. Proactive steps to avoid future breaches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Breach Response: An important part of Analyze and fix vulnerabilities

A

Re-evaluate 3rd party service providers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Breach Response: Notify appropriate parties. Who must be notified?

A

Law enforcement, usually through Attorney’s General, if PHI then HHS and the media, Business partners if contracts say so, and Affected individuals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Breach Response: Notification, FTC Recommendations

A

Consult law enforcement so you don’t impede any investigation, Designate a communication person, a year of free credit monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Breach Response: Notification Letter should contain

A

Clear description of what happened, Contact information of the organization, Steps an affected individual can take

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Breach Response: Avoid future breaches

A

Employee training, Third party security audits, Analyze the entire breach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Benefit of inventorying and classifying data

A

Creating a privacy program, Incident response program, and Workforce training

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Workforce training is…

A

Part of the accountability principle, lower costs of responding to breaches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

HIPAA training requirements

A

All members on policies and procedures for PHI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

GLBA training requirements

A

Identify reasonable and foreseeable internal and external risks, employee training and management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Red Flags Rule requirement

A

Establish an identity theft program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Who created the Red Flags Rule

A

the FTC uner authority of the Fair and Accurate Credit Transactions Act of 2003 (FACTA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Massachusetts safegaurd

A

Anyone owning or licensing information about a Massachusetts resident must have a secrutiy program and employee training

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

PCI-DSS requirement

A

A security awareness program to be in place

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

GDPR Article 5 Compliance

A

The data controller is responsible for compliance and demonstrates compliance through documentation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is the Accountability Principle

A

Implementing technical and organization measures to demonstrate the handling of personal information is done in accordance with the law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Means to hold organizations accountable

A

Policies, Procedures, Governance, Monitoring, Training

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

How compliance for the Accountability Priciniple is up to

A

the Organization to determine

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

How long should you retain data

A

Only for so long as necessary to achieve it purpose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

When data is no longer needed it should be

A

Destroyed or anonymized

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Laws governing data retention

A

Fair and Accurate Credit Transaction Act (FACTA) for the Disposal Rule, and Fair Credit Reporting Act (FCRA) for Identity Theft

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

One of the best ways to limit risk

A

Limit the length of time data is retained

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Server side languages

A

PHP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Browser side languages

A

HTML, CSS, XML, JavaScript

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Explain Web Client, Web Server, Web Browser

A

Web client downloads files from the web server and the web browser interprets and displays them to the user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

HTTP

A

How the web client and the web server communicate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

TCP protocol

A

Breaks information into packets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

IP protocol

A

Interfaces with the physical infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

TCP/IP

A

Is the main commiunication protocol of the internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

TLS

A

transport layer security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

IP Address

A

a unique number assigned to each device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

URL

A

name and web address assigned to files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

DNS

A

the phone book of the internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Proxy server

A

intermediate web server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

VPN

A

establishes an encrypted connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

A server log contains

A

IP Address, date and time of the page requested, URL of the file, broswer type, URL visited prior

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Cache

A

content stored locally

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Data automatically collected without you knowing it

A

Passive data collection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Data collected with the users knowing it

A

Active data collection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Just in time

A

privacy notice done at the point of collection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Syndicated content

A

purchased or licensed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Web services are…

A

a program contained wth a website

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

iFrame is…

A

a web page imbedded into another one

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

Spam

A

unsolicited emails

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

Malware

A

malicious software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Spyware

A

malware downloaded covertly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

Ransomware

A

malware that locks or encrypts your operating system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Phishing

A

communication designed to trick users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

SQL Injection

A

provide a dbase command to a web server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

XSS

A

malicious code injected into a webpage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Cookie Poisoning

A

a cookie is modified to gain unauthorized access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

Unauthorized Access

A

access through fraudulent means

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

Data validation

A

data conforms to requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Data sanitization

A

removing harmful characters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

Social engineering

A

manipulating a user to create a security vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

Behavioral advertising

A

advertising based upon information associated with an individual

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

AdChoices

A

Icon, consumers to exercise choice, Digital Advertisiing Alliance (DAA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

EU Cookie Directive

A

prevent cookie tracking without consent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Cross device tracking

A

map a user moving from a laptop to a mobile device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

Methods of cross device tracking

A

deterministic tracking, probabilistic tracking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Deterministic tracking

A

track where ther person logs into

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

Probabilistic tracking

A

collects information from multiple devices and draws inferences based on probabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

Web beaconing

A

one pixel image stored on your computer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

Adware

A

monitors users behavior

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

Location based advertising

A

uses the devices GPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

Bluetooh beaconing

A

signals sent rom a beconing device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

Digital fingerprinting

A

automatically collect user data when you visit a webpage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

Web cookie

A

text file placed on your hard drive by a web server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

Session cookie

A

text file ony used while connected that web server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

Persistent cookie

A

long lived cookie set to expire sometime in the future

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

First party cookie

A

owned by the host of the web server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

Third party cookie

A

owned by the someone other than the weber server host

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

Flash cookie

A

cookie stored outside the browsers control, dangerous, respawn, zombie cookies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

Cookie best practices

A

stored information should be encrypted, only use persistent cookies where necessary and should expire in a reasonable time, provide notice to cookie usage, disclose 3rd party cookie providers, provide an opt-out function, follow general FIPs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

COPPA

A

Childrens Online Privacy Protection, childeren under 13

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

GDPR child privacy

A

Children under 16

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

States , children between 13 and 18

A

California and Deleware, California Minors in the Digital World Act, Deleware Online and Personal Privacy Protection Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

CCPA regarding children

A

California Consumer Privacy Act, no selling info of children under 16 without consent, Data Controller may obtain consent from he child through an opt-out procedure, under 13 consent is from the parent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

Privacy notices are…

A

document, states how a company collects, stores, and uses personal information it gathers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

Privacy notice, used internally…

A

tells employees how personal information should be stored, accessed, and utilized.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

Privacy notice, used externally

A

informs consumers how their personal information will be used, helps consumers make an informed decision

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

COPPA and privacy notice display

A

maintain a link on the website and each page where personal information is collected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

GLBA and privacy notice

A

send customers the privacy policy each year

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
116
Q

CalOPPA

A

conspiciously post the privacy policy on the website and mobile apps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
117
Q

CalOPPA, privacy policy must include

A

categories of personal information, categories of third parties, how to request changes, how the policy is updated, it’s effective date, how it responds to do-not-track, if a third party can collect personal information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
118
Q

FTC can bring enforcement , privacy policy

A

privacy policy not being followed is an unfair or deceptive trade practice, FTC can bring enforcement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
119
Q

Privacy policy is a legal document, true or false

A

t

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
120
Q

Privacy policy lifecycle

A

designing, developing, testing, releasing, revieweing and updating

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
121
Q

FTC and data usage

A

data should be used in a manner consistent with the notice what was in effect at the time data was obtained

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
122
Q

FTC and material change

A

express, affirmative consent should be given by consumers before making material retroactive changes to data usage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
123
Q

FTC and material change definition

A

at a minimum, sharing consumer information with third parties after committing not to share the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
124
Q

Layered notice

A

short at the top, option to review the detailed longer privacy notice

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
125
Q

Privacy dashboard is what

A

one point to manage all privacy preferences

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
126
Q

Privacy icons are what

A

symbols used to indicate how information is processed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
127
Q

Article 29 Working Party and icons

A

to enhance transparency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
128
Q

Vendors, who is legally responsible

A

the data controller is responsible for any data misuse by vendors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
129
Q

HIPAA and vendors

A

Data controllers must have written contracts with their business associates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
130
Q

Article 28 GDPR and contracts part 1

A

Data controllers to have written contacts in place before processing may occur

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
131
Q

Article 28 GDPR and contracts part 2

A

Data controller to have sufficient gaurantees from their third parties, properly vet and contract the 3rd parties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
132
Q

Choosing , Vetting Vendors, basic guidelines

A

Consider their reputation, financial condition, and security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
133
Q

Vendor contracts to include…

A

confidentialiy provisions, security protections, audit rights, no further use provision, subcontractor use, information sharing, breach notification, consumer consent, data classification system, and an end of relationship provision

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
134
Q

Vendor contracts should be consistent with…

A

the organization’s privacy notice and practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
135
Q

Many of the largest data breaches came in through…

A

3rd party vendors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
136
Q

Data residency

A

physical location of the servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
137
Q

CCPA and data sharing

A

California consumer privacy act, users have the right to opt-out of data selling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
138
Q

Virginia and data sharing

A

Virginia consumer data protection act, user can opt-out of targeted advertising, data selling, and profiling

139
Q

CPRA and contracts

A

California privacy rights act, data controllers to have contracts with any party they share data with

140
Q

Data residency can…

A

dictate what laws apply

141
Q

Surprise minimization rule

A

a person’s information is subject to the laws of their home jurisdiction

142
Q

GDPR core purpose

A

facilitate the free flow of data between EU member states

143
Q

3 ways to transfer data between EU and non member states

A

Adequacy decision, appropriate safeguards, derogations

144
Q

Appropriate safeguards, GDPR

A

BCRs, EC model clauses, National model clauses, Codes of conduct, Certification, Ad Hoc contract

145
Q

Derogations, GDPR

A

Consent, Performance of contract, Public interest, Legal claims, Vital interests, Legitimate interest

146
Q

Article 45, GDPR, Adequacy decision is…

A

equivalent or greater protection in the transferee country

147
Q

Schrems 1

A

no more safe harbor, in part because of Edward Snowden

148
Q

Schrems 2

A

no more privacy shield, facebook ireland

149
Q

Binding corporate rules

A

a company’s rules for internally handling data transfer, don’t apply to data transfers with 3rd parties

150
Q

Article 47, GDPR, before using BCRs

A

it must be certified by a privacy supervisory agency in the EU

151
Q

BCRs must contain the following

A

binding contract rules must contain stuff about, transparency, quality, security, audit, training, compliance procedures, a binding element

152
Q

SCCs

A

standard contract clauses, a company contractually promises to comply with EU law

153
Q

Shrems 2 and SCCs

A

the transferee country equivalent protections as GDPR, the clause and the legal system, or the supervisory authority should suspend the transfer priviledges

154
Q

Codes of Conduct and Certifications

A

have to get approval from an EU data protection authority or the EU commission, the data protection authority has enforcement authority to include suspension

155
Q

Article 49, GDPR, Derogations

A

last resort

156
Q

Shrems 2 , controllers and processors

A

controllers and processors to conduct a transfer impact assessment prior to transferring personal data

157
Q

Transfer impact assessment (TIA) is

A

a risk assessment of transferring data to a third countries, considers SCCs, legal system, adequacy decision stuff

158
Q

European Data Protection Board (EDPB) and 6 steps

A

understand all transfers of personal data, verify all transfer tools, assess if appropriate safeguards will be impinged upon, identify supplemental measures, steps for supplemental measures, re-evaluate the level of protection in the trasferee country

159
Q

Supervisory authority can suspend or end transfers, true or false

A

t

160
Q

Schrems 2, Austrianand French DPAs, Google…

A

Google Analytics violates Chapter V of GDPR, SCCs didn’t provide appropriate safegaurds, US intelligence agencies could access data

161
Q

Privacy operational lifecycle is the cornerstone…

A

cornerstone of privacy program management

162
Q

Privacy operational lifecycle 4 steps

A

discover (assess), build (protect), communicate (sustain), evlove (respond)

163
Q

Privacy operation lifecycle 4 steps more detail

A

(1) Discover/Assess (including “Issue identification and self-assessment” and “Determination of best practices”); (2) Build/Protect (including “Procedure development and verification” and “Full implementation”); (3) Communicate/Sustain (including “Documentation” and “Education”); and (4) Evolve/Respond (including “Affirmation and monitoring” and “Adaptation”)

164
Q

Information Lifecycle Management, Data Lifecycle Management, Data Lifecycle Governance…

A

a policy based approach to managing the flow of information through a lifecycle

165
Q

A privacy notice may also be called a

A

privacy policy, privacy statement, fair processing statement, strictly speaking the notice is internal facing the policy is external facing

166
Q

GDPR requirements are based on …

A

Fair information practices (FIPs)

167
Q

GDPR applies to companies that…

A

have assets and employees in the EU, data stored in the EU, and data interactions with EU residents

168
Q

A company / country may be subject to the GDPR if it processes information…

A

of EU data subjects that access their websites or digital products

169
Q

GDPR fine

A

4% of the company’s global revenue

170
Q

DPAs

A

Data protection authorities ,one in each EU country, but Germany has 1 national and 16 state level, DPAs enforce the GDPR

171
Q

DPAs power

A

investigate, correct, advise; ask for records and proof of compliance, ban/stop/suspend data procecssing, require additional breach notification, order erasing of information, suspend cross boarder data flow

172
Q

GDPR articles 12-14

A

Transparent communication

173
Q

GDPR article 15

A

Right to access

174
Q

GDPR article 16

A

Rectify data

175
Q

GDPR article 17

A

Erasure

176
Q

GDPR article 18

A

Restrict processing

177
Q

GDPR article 19

A

Notification obligation to data subjects about their rights

178
Q

GDPR article 20

A

Data portability

179
Q

GDPR article 21

A

Object to processing personal information

180
Q

GDPR article 22

A

No Automated processing

181
Q

Data Controller is responsible for ensuring Data Subject rights, True or False

A

t

182
Q

Data Controllers to take action on Data Subject requests no later than…

A

30 days after receipt, possible to get an extension of 60 days if the request is burdensome

183
Q

Breach Notification, Data controllers to notify DPAs within how many hours

A

72

184
Q

Breach Notification, Processors notify the Controller within

A

Without undue delay

185
Q

Breach Notification, Controllers notify the Data Subjects within

A

Without undue delay

186
Q

Controllers are exempt from notifying Data Subjects if

A

Data is unintelligible, taken steps to minimize risk, would require disproportionate effort

187
Q

APEC is what

A

Asia Pacific Economic Cooperation, founded in 2004

188
Q

APEC privacy framework is similar to

A

FIPs in APEC is similar to Madrid Resolution

189
Q

APEC privacy framework includes what

A

preventing harm, notice, collection limitation, use of personal information, choice, integrity of information, security safeguards, access, correction, accountability

190
Q

CPEA is what

A

Cross boarder privacy enforcement agreement, APEC

191
Q

Rationalizing

A

multi jurisdiction, key practices to most restrictive laws

192
Q

FTC was founded when

A

1914

193
Q

Why was the FTC founded

A

Antitrust laws

194
Q

Wheeler Lea Act did what to the FTC

A

In 1938 it gave it general consumer protection authority, referred to as Section 5

195
Q

FTC is governed by

A

5 people, a chairperson and 4 commissioners

196
Q

FTC oversees what

A

privacy, fair credit reporting act (FCRA), CAN-SPAM act, COPPA

197
Q

Section 5 of FTC is the most important …

A

most important piece of federal privacy legislation

198
Q

Section 5 states what aboun unfair practices

A

unfair or deceptive acts or practices affecting commerece are unlawful

199
Q

2006 section 5 was ammended for what

A

apply to acts of foreign trade

200
Q

FTC doesn’t apply to whom

A

non-profits, banks, financial institutions, common carriers

201
Q

Magnuson-Moss did what for the FTC

A

permitted it to issue regulations

202
Q

FTC main prosecution method is what

A

To bring enforcement actions

203
Q

FTC hears about stuff how

A

news, public complaints, etc.

204
Q

What is section 6 of the FTC

A

Investigatory powers

205
Q

FTC section 6 has authority to

A

require business to submit written reports, subpoena power

206
Q

FTC pre-complaint is non public, true or false

A

t

207
Q

FTC standard to initiate a complaint

A

If the FTC has reason to believe

208
Q

Respondent defends themselves in front of whom

A

An Administrative Law Judge (ALJ)

209
Q

ALJ will issue what…

A

an injunction, ALJ can not impose civil penalties

210
Q

FTC, how do appeals work

A

ALJ to FTC commissioners to Federal Circuit Court

211
Q

FTC can also do what under 13(a)

A

Prosecute claims before a Federal District Court, review by the Federal Appelate Court

212
Q

Most FTC actions are consent decrees, T or F

A

t

213
Q

Consent decree has the force of a Federal Court Order, T or F

A

t

214
Q

Consent decrees are posted publically T or F

A

TRUE , to provide guidance to other companies

215
Q

Benefits of consent decrees

A

Enforces good practice, avoid expense, easily enforceable, avoid additional negative press, limits exposure to business practices to competitors

216
Q

To establish a deceptive trade practice the FTC needs

A

a material statement or omission that is likely to mislead consumers who are acting reasonably

217
Q

GeoCities

A

first privacy enforcement action, GeoCities sold information

218
Q

Eli Lilly

A

first consent decree, revealed email addresses

219
Q

Snapchat

A

collecting names and phone numbers, and messages didn’t get deleted

220
Q

TrustArc

A

did not conduct annaul re-certifications

221
Q

Nomi

A

tracked consumers via mobile devices

222
Q

LifeLock

A

couldn’t prevent all identity theft

223
Q

Facebook

A

3rd party developers could access user data

224
Q

Zoom

A

weak encryption, secretly installed software

225
Q

To establish an unfair trade pratice the FTC must prove

A

Substantial injury, lack of off setting benefits, and consumers could’t have reasonably avoided

226
Q

DesignerWare

A

log key strokes, take screen shots, photograph anyone with the camera, geo track users

227
Q

Wyndham

A

upheld FTCs unfairness authority, affirmed FTCs authority to regulate cybersecurity

228
Q

Section 18 of the FTC Act

A

rule making authority for unfair or deceptive trade practices, i.e. trade rules

229
Q

LabMD

A

disclosed patient information

230
Q

LabMD v. FTC

A

FTCs cease and desist was unenforceable, FTC started holding public hearings

231
Q

Uber

A

weak security measures

232
Q

Lenovo

A

man in the middel attacks, pre-installing software

233
Q

D-Link

A

exposed routers and web cameras to attack

234
Q

2018 most high profile case

A

Venmo

235
Q

Paypal

A

falsely claimed to have bank grade security

236
Q

BLU products

A

didn’t have appropriate security measures

237
Q

Vtech

A

COPPA violations

238
Q

Equifax

A

didn’t have reasonable security measures

239
Q

Tapplock

A

IoT data and physical security issues

240
Q

SkyMed

A

unsecured cloud storage

241
Q

Ascension Data and Analytics

A

violated GLBA, mortgage information

242
Q

COPPA applies to non profits Tor F

A

False

243
Q

COPPA personal information also includes

A

geolocation data, IP addresses, and info stored in cookies

244
Q

COPPA applies to

A

all operators of commercial websites

245
Q

COPPA notice includes

A

information collected, how used, if info is disclosed to third parties

246
Q

Forms of verifiable consent COPPA

A

mail or fax a consent form, credit card, debit card, call a toll free number, video conference, government issued ID

247
Q

COPPA consent exception

A

collected for the purpose of increasing security

248
Q

COPPA, parental rights

A

access information, withdraw consent

249
Q

COPPA has a safe harbor T or F

A

True, participate in a seal program

250
Q

Two states with laws for children between 13 and 18

A

California and Deleware

251
Q

COPPA, state AG can also prosecute, T or F

A

t

252
Q

Data Broker is what

A

Collect personal information of consumers and resell it

253
Q

Big data

A

Large amounts of data, analyized to get insights on consumer behavior

254
Q

FTC data broker minimization practices

A

2014, data brokers to use data minimzation practices as they relate to children

255
Q

FTC 2016 report on big data

A

Potential harm from inaccurate predictions

256
Q

IoT privacy and security concerns

A

Consumer consent, no UI, need new models of FIPs and security by design

257
Q

HIPPA law orginally for what

A

shift to electronic reimbursement requests, ,efficiency of healthcare

258
Q

HHS rules for administering simplication

A

Privacy rule and the Security rule

259
Q

Privacy and Security rule apply to whom

A

Covered entities and Business associates

260
Q

What is a covered entity

A

A healthcare provider that bills for insurance

261
Q

What is a business associate

A

Any person or entity that receives health information from a covered entity to provide services on behalf of the covered entity

262
Q

What is PHI

A

individually identifiable health information

263
Q

The terms covered entity, business associate, and PHI were codified …

A

In HITECH

264
Q

Minimum necessary requirement

A

limit PHI to the minimum necessary to accomplish the intended purpose

265
Q

Limited data set

A

Data set with facial identifiers removed, 16 categories

266
Q

Patient authorization

A

independent document, plain language, description,person, party, purpose, expire, dated and signed

267
Q

PHI disclosure documentation authorizations

A

Covered entitiy to keep a record, give to the individual upon request

268
Q

PHI disclosure exceptions

A

Emergency, public health activities, report victims of abuse or domestic violence, court, law enforcement, research, investigate compliance

269
Q

PHI privacy notice must be given when

A

date of first service, compliance date, time of enrollment, upon request of the person

270
Q

PHI designated record set

A

Medical, billing, enrollment, any other information used to make decisions

271
Q

PHI right to access records

A

Access the designated record set, except for psychotherapy notes or information collected for a legal proceeding or regulatory action

272
Q

PHI access request timeline

A

within 30 days

273
Q

PHI disclosures accounting timeline

A

can request the last 6 years

274
Q

HIPPA security rule standards

A

ensure CIA, threats, PHI uses or disclosures, ensure compliance

275
Q

Security measure decision criteria

A

the measure’s size, complexity, capabilities, technical infrastructure, cost, risk ocurrance probability, potential risks

276
Q

HIPPA, forms of security rule implementation

A

Required and Addressable

277
Q

HIPAA, privacy and security rule, are contracts between parties mandatory

A

Yes

278
Q

Enforcement of HIPPA privacy and security rules

A

OCR, FTC, DOJ, State Attorneys General

279
Q

HIPPA privacy and security rule, time to fix violations

A

30 days

280
Q

HIPPA preemption, state requests

A

States can request their law is not preempted, have to ask HHS, California Medical Information Privacy Act is an example

281
Q

HIPPA safe harbor

A

A company has recognized security practices in place not less than 12 months

282
Q

Why have a HIPPA safe harbor

A

Give HHS greater discretion imposing fines

283
Q

What is contact tracing

A

Mapping a person’s contact with others, communicable diseases

284
Q

HIPPA doesn’t impact contact tracing, T or F

A

t

285
Q

Biggest things HITECH did

A

Rules for data breaches, increased penalties, gave great acess to records, codified terms

286
Q

Data breach is presumed unless

A

There is a low probability of compromise based on nature and extent of disclosure, who the person was that accessed it, was it acquired or viewed, extent the risk has been mitigated

287
Q

Data breach notice period to affected people

A

60 days

288
Q

Data breach >500

A

Notify media outlets, within 60 days

289
Q

Data breach always notify …

A

Secretary of HHS

290
Q

Data breach notification period extended if…

A

Law enforcement says so

291
Q

HHS oversees GINA, T or F

A

t

292
Q

GINA is PHI under HIPPA, T or F

A

t

293
Q

Cures Act did what

A

Share infor with family and care givers, biomed research confidential, allowed for remote viewing of PHI, no information blocking

294
Q

What is a Part 2 Program

A

Any federally assisted program that provides training or treatement for substance use

295
Q

Substance Use patient record disclosure exceptions, can disclose if..

A

Patient consents, veteran affairs, crimes, child abuse, medical emergency, audits, court order

296
Q

Substance Use patient record use restrictions..

A

can’t use to initiate criminal charges or criminal investigation

297
Q

Part 2 Programs must do..

A

provide notice of rights, formal security program, protect paper and electronic records, destroy records when the company leaves the Part 2 program

298
Q

The FCRA is what

A

Fair credit reporting act

299
Q

FCRA came from where

A

Title VI of FDIC and amended the Consumer Credit Protection Act (CCPA)

300
Q

First federal law protecting personal information from private businesses is..

A

Fair credit reporting act (FCRA)

301
Q

Who the FCRA applies to

A

Any consumer reporting agency (CRA) or users of a consumer report, furnishers of information to the CRA, companies that extend credit - red flags rule

302
Q

What the FCRA applies to

A

Consumer reports

303
Q

What is a consumer report

A

written, oral, or other communication used for eligibility for credit, insurance, employment, character, reputation, mode of living

304
Q

Consumer report exceptions

A

Not a consumer report if it’s transactional, between affiliates, consumer is provided an opt out of affiliate sharing

305
Q

FCRA permissable purpose

A

CRAs can’t share a consumer report unless the user has a permissable purpose

306
Q

FCRA permissable purpose list

A

court order, consumer consent, credit transaction, employment purpose, insurance, gov benefits, assess credit risk, account terms, travle charge cards, child support, liquidation

307
Q

FCRA employment purpose

A

offer, promotion, reassignment, retention

308
Q

FCRA credit transaction purpose

A

consumer consent, firm offer of credit or insurance

309
Q

FCRA firm offer purpose

A

firm offers of credit or insurance, the CRA must maintain a notification system and allow users to opt out

310
Q

FCRA firm offer opt out is good for..

A

5 years

311
Q

FCRA signed notice of election implemented when..

A

must be implemented within 5 business days

312
Q

Can CRAs provide consumer reports with medical information

A

Only if it is coded for insurance purposes

313
Q

Consumer reports with medical information..

A

Users are prohibited from re-disclosing that consumer report

314
Q

FCRA CRAs have to ensure the report is …

A

the consumer report has to be accurate, current, and complete

315
Q

Credit report exclusions

A

Bankruptcy >10 years, other stuff more than 7 years old

316
Q

Credit report exclusions don’t apply if..

A

Don’t apply to credit, life insurance >$150K, employment >$75K salary

317
Q

Credit report must include

A

Bankruptcy chapter, number of credit inquiries, credit account voluntarily closed, any dispute information

318
Q

CRAs are obligated to maintain what..

A

procedures

319
Q

CRA procedures should ensure what..

A

identity of users are validated, consumer reports are accurate

320
Q

CRAs must provide notices to…

A

both uses and furnishers of information

321
Q

Consumer report access 1

A

Consumers have a right to see all the information in their file maintained by the CRA

322
Q

Consumer report access 2

A

Consumers have a right to see everyon their report was given to in the last 2 years for employment, last 1 year for everything else

323
Q

CRAs are required to provide credit score to consumers, T or F

A
324
Q

CRAs are required to provide their sources to consumers, T or F

A
325
Q

Before making any disclosure to a consumer, the CRA must

A

Confirm the consumer’s identity

326
Q

When CRAs make disclosures to a consumer it must..

A

Be in writing, unless consumer consents otherwise, and it must include a summary of the consumer’s rights

327
Q

Consumer files a dispute, CRA must complete their investigation in how many days

A

30 days

328
Q

The FCRA refers to a investigating a consumer dispute as what..

A

A re-investigation

329
Q

CRA provide notice of the consumer dispute to the Furnisher within how many days

A

5 days

330
Q

CRAs must delete information from their files if..

A

The reinvestigation reveals the information was inaccurate, incomplete, or can’t be verified

331
Q

If the CRA deletes information from their file they must do what..

A

Notify anyone who received the consumer report within the last 6 months, or for 2 years if it was for employment purposes

332
Q

CRA re-investigation results must be provided to the consumer within how many days

A

Within 5 days of it being completed

333
Q

CRAs, if a consumer provides a statement of disagreement it must..

A

it must be included in all future consumer reports containing the disputed information

334
Q

When an adverse action it taken against a consumer because of a consumer report what must happen..

A

notice must be given to the consumer

335
Q

When a consumer report adverse action is taken the notice to the consumer must contain

A

The name and contact information of the CRA, a statement the CRA isn’t responsible for and can’t explain anything, their right to request a free copy within 60 days, thei right to protest it

336
Q

Consumer report, adverse action, due to credit score..

A

Consumer to be provided a credit score and information to understand the score

337
Q

Consumer report liability can be avoided if..

A

If reasonable procedures are in place to ensure compliance to the law

338
Q

Consumer report adverse action employment

A

A copy of the report must be given to the consumer along with their rights, before taking action, however, if the consumer submitted the employment application by mail, phone, computer, they don’t need to do this

339
Q

Consumer report adverse action employment, provide notice within how many days

A

within 3 days aftter taking action, and provide name and contact infor of CRA, statement, and how to get a free copy

340
Q

Consumer report reselling

A

Tell the CRA, who the user is, permissable purpose, procedures in place, verify identity and certifications of recipient

341
Q

Limited consumer report is used where

A

For firm offers of credit or insurance not initiated by a consumer, i.e., companies creating a prequalificaiton list for their product or service

342
Q

Companies using limited consumer reports must do what..

A

maintain records of the prescreen criteria for 3 years

343
Q

Consumer report offer solicitation, opt out..

A

CRA file was used, they are credit worthy, service can be withheld if fail further screening, consumer can prohibit (opt out of) similar solicitations by contacting the CRA

DP (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions