Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Data Privacy > Flash Cards 3 > Flashcards

Flash Cards 3

1
Q

4 types of privacy

A

information, bodily, communication, territory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Identified individual is what

A

ascertained with certainty

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Turn personal info into non personal info by

A

de-identifying it or anonymizing it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Encryption is what

A

making data unrecognizable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Anonymization is what

A

stripping it of identifying info

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Pseudonymization is what

A

associate it with a pseudonym

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Sources of information are

A

public, publically accessible, and non public

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Data subject

A

person whos data is processed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Data controller

A

The organization that decides how information is processed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Data processor

A

The organization that processes the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

FIPs

A

Balance privacy with security and fairness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

DHEW renamed HHS promulgated FIPs , T or F

A

t

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

The FIPs 5 organizational practices

A

No secret systems, know what’s in your record and how used, prevent misuse, correct errors, data reliability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Privacy Act of 1974 codified what..

A

FIPs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Examples of FIPs in the U.S.

A

1973 FIPs, Privacy Act 1974, 20212 White House Report, 2012 FTC Report

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

FTC report had 3 key things..

A

Privacy by design, simplified consumer choice, transparency in company data practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

FTC report prioritized 5 areas..

A

Do no track, mobile device data, data brokers, tracking by large comapnies, self regulation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

International FIPs examples

A

OECD, European Council Convention, Madrid Resolution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

FIPs individual rights

A

Notice, consent, access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

FIPs organization responsibilities

A

security, data quality, limitation principle, accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

OECD is what..

A

Organization of economic cooperation and development; privacy and transborder flow of personal data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

OECD 8 principles

A

collection limitation, quality, specific purpose, use limitation, security, openess, individual participation, accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Council of Europe Convention..

A

Automatic processing of personal data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Council of Europe Convention incorporates…

A

FIPs into domestic laws

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Council of Europe Conventional Article 5

A

data quality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Council of Europe Conventional Article 6

A

categories of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Council of Europe Conventional Article 7

A

Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Council of Europe Conventional Article 8

A

Data subject safeguards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Madrid Resolution..

A

Standards on data protection, uniformity, transborder data flow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

what is Notice

A

How an organization processes personal information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

what is Consent

A

How your personal information is collected, used, and retained

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

what is Access

A

Giving you access to your personal information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Types of security controls

A

Physical (locks, cameras), Technical (code, systems) , Administrative (policies)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

what is Data Quality

A

data should be accurate, complete, and relevant

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

what is Accountability

A

data to be defined and documented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Sources of privacy protection are

A

Government, regulations, market

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

what is the goal of legal protection

A

compensation and deterrence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Market protections arose because of

A

consumers react to data policies, publicity of data breaches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Self regulatory protection examples

A

PCI-DSS, DAA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Self regulatory protections bring together..

A

Industry standards and legal standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What are the two protection privacy regimes

A

Sectoral and Comprehensive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Example of a sectoral privacy regime

A

United States

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Example of a comprehensive privacy regime

A

Europe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Critiques of sectoral model

A

Divergent policies, inadequate, overly burdensome

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Critiques of comprehensive model

A

costs outweigh benefit, doesn’t account for unique situations, discourages innovation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is a cor-regulatory model

A

Combines self regulatory and either the sectoral or comprehensive model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Self Regulation is sometimes thought of as a …

A

3rd model alongside Sectoral and Comprehensive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What are the 3 branches of government

A

Executive, Legislative, Judicial

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Which article of the constitution vests legislative power

A

Article I

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Executive branch, which constitution article

A

Article II

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Judicial branch, which constituional article

A

Article III

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

How many regional circuit courts

A

12

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Federal judicial system process

A

Federal district court, appeal to US circuit court, appeal to US Supremen court

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Most important circuit court is what

A

D.C. circuit court

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Legislative branch checks

A

Executive branch, veto override, impeach, approve appointments; Judicial branch, change laws, approve judges, impeach judges, court jurisdiction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Executive branch checks

A

Legislative branch, veto; Judicial branch, appoint judges

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Judicial branch checks

A

Legislative branch, unconstitutional; Executive branch, unconstitutional, interpretations invalid

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Sources of law

A

Constitution, Satutory Law, Regulations and Administrative Rulemaking, Common Law, Contractual Law, International Law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

The foundation of law is what

A

The constitution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Most significant privacy requirements come from where

A

Federal and State legislation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Statutory law is what

A

Legislation (laws) from Federal and States

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Regulations and Administrative Rulemaking is what

A

Federal agencies enforcing statutory law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Common Law / Case Law is what

A

Societal customs and judicial decisions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Stare Decisis is what

A

Stand by things decided

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What is the basis for many privacy related docterines

A

Common Law / Case Law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Contractual Law is what

A

Legally binding agreements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

A legally binding agreement must have what

A

Offer, Acceptance, Consideration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What is a consent decree

A

a contract, party agrees to abide by a judgement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Consent decree benefits

A

avoid admitting guilt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

International Law is what

A

Laws in foreign jurisdictions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

What is jurisdiction

A

A court’s authority to hear a case

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Types of jurisdiction

A

Personal, Subject Matter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

What is preemption

A

Federal law override or supersede inconsistent state law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

The supremacy clause is the basis for what

A

The doctrine of preemption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

What is Subject Matter jurisdiction

A

A court’s authority to hear specific types of disputes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

What is Personal jurisdiction

A

A court’s authority between people or to bring people into its process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

What is a natural person

A

A human

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

What is a person

A

A company

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

Why was the FTC founded

A

To protect consumers against unfair or deceptive trade practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

The FTC is lead by what

A

a 5 member bipartisan commission

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

The Federal Reserve Board info

A

12 banks, 7 governors, 14 year term

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

The FTC is the most important Federal privacy regulator, T or F

A

t

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Civil ligitagation standard of liability

A

Perponderance of evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

Criminal litigiation standard of liability

A

Beyond a reasonable doubt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

Person brining the lawsuit in Criminal litigation

A

DOJ for Federal crimes, and the State prosecutor for State crimes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Person brining the lawsuit in Civil litigation

A

Plaintiff

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

What is legal liability

A

The defendent is legally obligated or accountable to the plaintiff

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

Breach of contract

A

one party fails to perform any of its contractual obligations at the time performance is due

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

Expectation Interest

A

had the contract been performed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

Reliance Interest

A

contract not been made

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Restitution Interest

A

unjustly enriched

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

Specific Performance of a contract

A

ordered to comply (fulfill) the contract

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Forum Selection Clause

A

which court will try (hear) the case

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

Arbitration Clause

A

use an arbitrator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

What is a Tort

A

a civil wrong

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

Intentional Torts

A

knows or should know it will cause harm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

Negligent Torts

A

failing to observe the standard of care

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

Strict Liability Torts

A

engaged in prohibited conduct

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

Privacy Torts

A

Intrusion Upon Seclusion, Appropriation of Name or Likeness, Publically Given to Private Life, False Light

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

Intrusion Upon Seclusion

A

intentionally intrude

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

Appropriation of Name or Likeness

A

use another’s name or likeness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

Publically Given to Private Life

A

make something public that isn’t a legitimate public concern

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

False Light

A

places someone in false light

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

Negligence

A

conduct that falls below the standard established by law for the protection of others against unreasonable risk of harm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

Administrative Procedures Act (APA)

A

rules for administrative enforcement actions, Federal rules of civil procedure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

Administrative actions are brought to …

A

an ALJ, administrative law judge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

What is UDAP

A

Unfair and Deceptive Acts and Practices, the state version of FTC unfair or deceptive trade practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

UDAP is enforced by …

A

State Attorney’s General

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

Every state except ?? provides a private right to action for UDAP

A

Iowa

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

Is there a Federal data breach law

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

UDAP and other state patch work laws govern what

A

Data breaches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

Who are the leading enforcement regulators for Data Breaches

A

State Attorney’s General

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

What is the National Association of Attorney’s General

A

How states coordinate responses to legal issues and exchange information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

What is GPEN

A

Global privacy enforcement network, connects privacy enforcement authorities around the world

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

What is APEC

A

Asia Pacific Economic Cooperation, cross boarder enforcement of privacy law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
116
Q

GPEN (global privacy enforcement network) 5 ways

A

exchanging info, training, dialogue, processes bilatteral and multilatteral cooperation, actions for communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
117
Q

What is CPEA

A

Cross boarder Privacy Enforcement Action, came out of APEC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
118
Q

Goals of CPEA (cross boarder privacy enforcement action)

A

information sharing, cross boarder cooperation, cooperation on privacy investigation and enforcement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
119
Q

What is self regulatory enforcement

A

self policing of industry groups for compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
120
Q

What are the benefits of self regulatory enforcement

A

industry expertise, increased efficiency, flexible, quicker to react,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
121
Q

What are the draw backs of self regulatory enforcement

A

anti competitive, not as robust as govt, lax enforcement, may not full incorporate perspectives of others not in the industry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
122
Q

What is co-regulatory enforcement

A

both industry and government jointly administer the process, an example is COPPA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
123
Q

What is the most prominent self regulatory program

A

PCI-DSS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
124
Q

PCI-DSS data points

A

Developed by the credit card companies, each CC company has its own program for compliance, it is overseen by the credit card companies (Security Standards Council)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
125
Q

PCI-DSS has 12 requirements

A

firewall, no defaults, stored data, encrypt transmissions, malware, secure systems, restrict access, authenticate access, restrict physical access, monitor access, test, policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
126
Q

Value of Trust Marks / Seal Programs

A

increase consumer confidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
127
Q

Who is responsible for enforcing the DAA principles

A

the Council of Better Business Bureaus (CBBB) and Digital & Marketing Association (DAA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
128
Q

How long after a valid request does an educational institution have to provide access to education records of a student?

A

A “reasonable” time, not to exceed 45 days.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
129
Q

What is a Data Assessment

A

generic term referring to processes like data inventory, data flow analysis, classifying data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
130
Q

What is a Data Inventory

A

identifies personal data as it moves across systems, shared, and stored, sometimes called Record of Authority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
131
Q

Why is a Data Inventory important

A

analyze what laws you need to comply with

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
132
Q

What is data residency

A

physical location of servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
133
Q

What is data location

A

where data is stored

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
134
Q

What is data access

A

who has access, how and when information is shared, who has internal access, what 3rd parties have access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
135
Q

What is a data flow map

A

how information moves through the organization, increase confidence in regulatory compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
136
Q

Data Inventory and Data Maps are synonomous, T or F

A

t

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
137
Q

What is Data Classification

A

classifying data by sensitivity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
138
Q

Data classification does what

A

provides the basis for managing access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
139
Q

What are the common sensitivity levels

A

confidential, proprietary, sensitive, restricted, public

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
140
Q

Classifying data facilitates what

A

laws are followed, limit consequences of breaches, limit scope of disclosure, lowers cost of responding to a data breach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
141
Q

What is the main function of a privacy professional

A

develop privacy programs / information management programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
142
Q

What are the types of risk

A

legal, reputational, operational, investement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
143
Q

What is legal risk

A

regulatory action, litigation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
144
Q

What is reputational risk

A

the trust consumers place in an organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
145
Q

What is operational risk

A

trade off between privacy programs and achieving organizational goals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
146
Q

What is investement risk

A

are the benefits of the program worth the cost

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
147
Q

The first step in a developing a privacy program is what

A

Developing a privacy vision / mission statement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
148
Q

Why have written policies

A

Ensure the program is implemented properly, basis for training, accountability, decision making

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
149
Q

What are the steps in the privacy operational lifecycle

A

Assess, Protect, Sustain, Respond, also Discover, Build, Communicate, Evolve

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
150
Q

Def of Privacy Operational Life Cycle

A

continuously monitors and improves the privacy program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
151
Q

What are the types of consent

A

Opt In, Double Opt In, Opt Out, No Option

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
152
Q

What is Opt In consent

A

express, reqires affirmative action

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
153
Q

What is Double Opt In consent

A

obtaining consent, then confirming it again

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
154
Q

What is Opt Out consent

A

passive, consent is implied, processing will occur unless you opt out

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
155
Q

What is No Option consent

A

implied by the circumstance, i.e. sharing your address with the post office

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
156
Q

Managing consent, how should it be done..

A

However you are interacting with the consumer, in the same manner allow them to consent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
157
Q

After a consumer disputes the accuracy of information in a consumer report, how long does a consumer reporting agency have to re-investigate the information?

A

30 days.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
158
Q

The California Consumer Privacy Act is an example of what type of privacy protection?

A

A comprehensive model.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
159
Q

How many days does an organization have to cure a violation of the CCPA before it may be subject to fines or a private cause of action?

A

30 days.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
160
Q

All of the following are best practices in obtaining consumer consent, except:

A

Companies should obtain a separate consent specifically applicable to third-party data processors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
161
Q

Under which of the following pieces of legislation are data brokers required to comply with a one-stop mechanism that allows data subjects to request the deletion of their personal data?

A

California’s Delete Act.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
162
Q

According to the Supreme Court’s decision in Société Nationale Industrielle Aerospaciale, all of the following should be considered in a comity analysis, except:

A

Whether the parties have domestic subsidiaries in the United States.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
163
Q

What is the most common phrase used in state-level data breach notification laws to describe when notice must be provided to affected individuals?

A

At the most expeditious time possible and without unreasonable delay.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
164
Q

What is the standard utilized by FISC to determine whether an application for a surveillance order should be granted?

A

Whether there is probable cause to believe that that the person being monitored is either a foreign power or an agent of a foreign power.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
165
Q

Who is responsible for enforcement under the Payment Card Industry Data Security Standard?

A

Individual payment card brands.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
166
Q

What change to the use of National Security Letters was implemented by the USA-PATRIOT Act?

A

An NSL may now be issued if relevant to an authorized investigation to protect against international terrorism or clandestine intelligence activities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
167
Q

If a third party accidently accesses protected health information without authorization, which of the following is accurate?

A

A breach is presumed unless a risk assessment establishes that there was a low probability that PHI has been compromised.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
168
Q

As defined under the Fair Credit Reporting Act, which of the following is least likely to be considered an “employment purpose” for which a consumer report may be obtained?

A

Determining whether an employee is entitled to a raise.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
169
Q

Which of the following most accurately states whether a data processor experiencing a data breach must disclose to a data controller that a breach occurred under state-level breach notification laws?

A

Every state requires that a data processor notify a data controller when a breach occurs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
170
Q

All of the following are benefits of data flow mapping, except:

A

It may limit the amount of data disclosed in the event of a data breach.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
171
Q

Which of the following best describes the enforcement of CAN-SPAM at the federal level?

A

The FTC enforces CAN-SPAM according to its “unfair and deceptive” trade practices authority but shares enforcement authority with prudential regulators.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
172
Q

In addition to “unfair” and “deceptive” trade practices, state UDAP laws also commonly prohibit what other type of act or practice?

A

“Unconscionable” acts or practices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
173
Q

Which is the most accurate advice that Jackson can provide to BotVoice about its compliance obligations under HIPAA?

A

HIPAA does not apply because the health information provided by children is not made in connection with a covered transaction.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
174
Q

CAN-SPAM-Act prohibits communication after how many days of opting out

A

more than 10 days

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
175
Q

OP-Out Consent is

A

A passive form, where consent is implied, processing occurs unless you opt-out

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
176
Q

Information privacy focuses on what

A

Policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
177
Q

Information security focuses on what

A

Protection of data from unauthorized access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
178
Q

Privacy focuses on what type of data

A

Personal information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
179
Q

Security focuses on what type of information

A

Confidential information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
180
Q

CIA triad stands for what

A

Confidentiality, Integrity, Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
181
Q

Security controls do what

A

Limit damage, loss, modification, and unauthorized access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
182
Q

Purposes of seurity controls

A

Preventative, Detective, Corrective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
183
Q

Preventive controls

A

Prevent an incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
184
Q

Detective controls

A

Identify an incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
185
Q

Corrective controls

A

Fix or limit the damage of an incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
186
Q

Types of controls

A

Physical, Administrative, Technical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
187
Q

OMB 7 step breach response

A
  1. Breach response team. 2. Privacy docs. 3. Sharing breach information. 4. Reporting. 5. Assess the risk. 6. Mitigating risk. 7. Notification.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
188
Q

FTC 4 step breach response

A

Confirm the breach. Then, 1. Secure Operations / Contain. 2. Analyze and fix vulnerabilities. 3. Notify. 4. Proactive steps to avoid future breaches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
189
Q

Breach Response: An important part of Analyze and fix vulnerabilities

A

Re-evaluate 3rd party service providers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
190
Q

Breach Response: Notify appropriate parties. Who must be notified?

A

Law enforcement, usually through Attorney’s General, if PHI then HHS and the media, Business partners if contracts say so, and Affected individuals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
191
Q

Breach Response: Notification, FTC Recommendations

A

Consult law enforcement so you don’t impede any investigation, Designate a communication person, a year of free credit monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
192
Q

Breach Response: Notification Letter should contain

A

Clear description of what happened, Contact information of the organization, Steps an affected individual can take

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
193
Q

Breach Response: Avoid future breaches

A

Employee training, Third party security audits, Analyze the entire breach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
194
Q

Benefit of inventorying and classifying data

A

Creating a privacy program, Incident response program, and Workforce training

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
195
Q

Workforce training is…

A

Part of the accountability principle, lower costs of responding to breaches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
196
Q

HIPAA training requirements

A

All members on policies and procedures for PHI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
197
Q

GLBA training requirements

A

Identify reasonable and foreseeable internal and external risks, employee training and management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
198
Q

Red Flags Rule requirement

A

Establish an identity theft program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
199
Q

Who created the Red Flags Rule

A

the FTC uner authority of the Fair and Accurate Credit Transactions Act of 2003 (FACTA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
200
Q

Massachusetts safegaurd

A

Anyone owning or licensing information about a Massachusetts resident must have a secrutiy program and employee training

201
Q

PCI-DSS requirement

A

A security awareness program to be in place

202
Q

GDPR Article 5 Compliance

A

The data controller is responsible for compliance and demonstrates compliance through documentation

203
Q

What is the Accountability Principle

A

Implementing technical and organization measures to demonstrate the handling of personal information is done in accordance with the law

204
Q

Means to hold organizations accountable

A

Policies, Procedures, Governance, Monitoring, Training

205
Q

How compliance for the Accountability Priciniple is up to

A

the Organization to determine

206
Q

How long should you retain data

A

Only for so long as necessary to achieve it purpose

207
Q

When data is no longer needed it should be

A

Destroyed or anonymized

208
Q

Laws governing data retention

A

Fair and Accurate Credit Transaction Act (FACTA) for the Disposal Rule, and Fair Credit Reporting Act (FCRA) for Identity Theft

209
Q

One of the best ways to limit risk

A

Limit the length of time data is retained

210
Q

Server side languages

A

PHP

211
Q

Browser side languages

A

HTML, CSS, XML, JavaScript

212
Q

Explain Web Client, Web Server, Web Browser

A

Web client downloads files from the web server and the web browser interprets and displays them to the user

213
Q

HTTP

A

How the web client and the web server communicate

214
Q

TCP protocol

A

Breaks information into packets

215
Q

IP protocol

A

Interfaces with the physical infrastructure

216
Q

TCP/IP

A

Is the main commiunication protocol of the internet

217
Q

TLS

A

transport layer security

218
Q

IP Address

A

a unique number assigned to each device

219
Q

URL

A

name and web address assigned to files

220
Q

DNS

A

the phone book of the internet

221
Q

Proxy server

A

intermediate web server

222
Q

VPN

A

establishes an encrypted connection

223
Q

A server log contains

A

IP Address, date and time of the page requested, URL of the file, broswer type, URL visited prior

224
Q

Cache

A

content stored locally

225
Q

Data automatically collected without you knowing it

A

Passive data collection

226
Q

Data collected with the users knowing it

A

Active data collection

227
Q

Just in time

A

privacy notice done at the point of collection

228
Q

Syndicated content

A

purchased or licensed

229
Q

Web services are…

A

a program contained wth a website

230
Q

iFrame is…

A

a web page imbedded into another one

231
Q

Spam

A

unsolicited emails

232
Q

Malware

A

malicious software

233
Q

Spyware

A

malware downloaded covertly

234
Q

Ransomware

A

malware that locks or encrypts your operating system

235
Q

Phishing

A

communication designed to trick users

236
Q

SQL Injection

A

provide a dbase command to a web server

237
Q

XSS

A

malicious code injected into a webpage

238
Q

Cookie Poisoning

A

a cookie is modified to gain unauthorized access

239
Q

Unauthorized Access

A

access through fraudulent means

240
Q

Data validation

A

data conforms to requirements

241
Q

Data sanitization

A

removing harmful characters

242
Q

Social engineering

A

manipulating a user to create a security vulnerability

243
Q

Behavioral advertising

A

advertising based upon information associated with an individual

244
Q

AdChoices

A

Icon, consumers to exercise choice, Digital Advertisiing Alliance (DAA)

245
Q

EU Cookie Directive

A

prevent cookie tracking without consent

246
Q

Cross device tracking

A

map a user moving from a laptop to a mobile device

247
Q

Methods of cross device tracking

A

deterministic tracking, probabilistic tracking

248
Q

Deterministic tracking

A

track where ther person logs into

249
Q

Probabilistic tracking

A

collects information from multiple devices and draws inferences based on probabilities

250
Q

Web beaconing

A

one pixel image stored on your computer

251
Q

Adware

A

monitors users behavior

252
Q

Location based advertising

A

uses the devices GPS

253
Q

Bluetooh beaconing

A

signals sent rom a beconing device

254
Q

Digital fingerprinting

A

automatically collect user data when you visit a webpage

255
Q

Web cookie

A

text file placed on your hard drive by a web server

256
Q

Session cookie

A

text file ony used while connected that web server

257
Q

Persistent cookie

A

long lived cookie set to expire sometime in the future

258
Q

First party cookie

A

owned by the host of the web server

259
Q

Third party cookie

A

owned by the someone other than the weber server host

260
Q

Flash cookie

A

cookie stored outside the browsers control, dangerous, respawn, zombie cookies

261
Q

Cookie best practices

A

stored information should be encrypted, only use persistent cookies where necessary and should expire in a reasonable time, provide notice to cookie usage, disclose 3rd party cookie providers, provide an opt-out function, follow general FIPs

262
Q

COPPA

A

Childrens Online Privacy Protection, childeren under 13

263
Q

GDPR child privacy

A

Children under 16

264
Q

States , children between 13 and 18

A

California and Deleware, California Minors in the Digital World Act, Deleware Online and Personal Privacy Protection Act

265
Q

CCPA regarding children

A

California Consumer Privacy Act, no selling info of children under 16 without consent, Data Controller may obtain consent from he child through an opt-out procedure, under 13 consent is from the parent

266
Q

Privacy notices are…

A

document, states how a company collects, stores, and uses personal information it gathers

267
Q

Privacy notice, used internally…

A

tells employees how personal information should be stored, accessed, and utilized.

268
Q

Privacy notice, used externally

A

informs consumers how their personal information will be used, helps consumers make an informed decision

269
Q

COPPA and privacy notice display

A

maintain a link on the website and each page where personal information is collected

270
Q

GLBA and privacy notice

A

send customers the privacy policy each year

271
Q

CalOPPA

A

conspiciously post the privacy policy on the website and mobile apps

272
Q

CalOPPA, privacy policy must include

A

categories of personal information, categories of third parties, how to request changes, how the policy is updated, it’s effective date, how it responds to do-not-track, if a third party can collect personal information

273
Q

FTC can bring enforcement , privacy policy

A

privacy policy not being followed is an unfair or deceptive trade practice, FTC can bring enforcement

274
Q

Privacy policy is a legal document, true or false

A

t

275
Q

Privacy policy lifecycle

A

designing, developing, testing, releasing, revieweing and updating

276
Q

FTC and data usage

A

data should be used in a manner consistent with the notice what was in effect at the time data was obtained

277
Q

FTC and material change

A

express, affirmative consent should be given by consumers before making material retroactive changes to data usage

278
Q

FTC and material change definition

A

at a minimum, sharing consumer information with third parties after committing not to share the data

279
Q

Layered notice

A

short at the top, option to review the detailed longer privacy notice

280
Q

Privacy dashboard is what

A

one point to manage all privacy preferences

281
Q

Privacy icons are what

A

symbols used to indicate how information is processed

282
Q

Article 29 Working Party and icons

A

to enhance transparency

283
Q

Vendors, who is legally responsible

A

the data controller is responsible for any data misuse by vendors

284
Q

HIPAA and vendors

A

Data controllers must have written contracts with their business associates

285
Q

Article 28 GDPR and contracts part 1

A

Data controllers to have written contacts in place before processing may occur

286
Q

Article 28 GDPR and contracts part 2

A

Data controller to have sufficient gaurantees from their third parties, properly vet and contract the 3rd parties

287
Q

Choosing , Vetting Vendors, basic guidelines

A

Consider their reputation, financial condition, and security controls

288
Q

Vendor contracts to include…

A

confidentialiy provisions, security protections, audit rights, no further use provision, subcontractor use, information sharing, breach notification, consumer consent, data classification system, and an end of relationship provision

289
Q

Vendor contracts should be consistent with…

A

the organization’s privacy notice and practices

290
Q

Many of the largest data breaches came in through…

A

3rd party vendors

291
Q

Data residency

A

physical location of the servers

292
Q

CCPA and data sharing

A

California consumer privacy act, users have the right to opt-out of data selling

293
Q

Virginia and data sharing

A

Virginia consumer data protection act, user can opt-out of targeted advertising, data selling, and profiling

294
Q

CPRA and contracts

A

California privacy rights act, data controllers to have contracts with any party they share data with

295
Q

Data residency can…

A

dictate what laws apply

296
Q

Surprise minimization rule

A

a person’s information is subject to the laws of their home jurisdiction

297
Q

GDPR core purpose

A

facilitate the free flow of data between EU member states

298
Q

3 ways to transfer data between EU and non member states

A

Adequacy decision, appropriate safeguards, derogations

299
Q

Appropriate safeguards, GDPR

A

BCRs, EC model clauses, National model clauses, Codes of conduct, Certification, Ad Hoc contract

300
Q

Derogations, GDPR

A

Consent, Performance of contract, Public interest, Legal claims, Vital interests, Legitimate interest

301
Q

Article 45, GDPR, Adequacy decision is…

A

equivalent or greater protection in the transferee country

302
Q

Schrems 1

A

no more safe harbor, in part because of Edward Snowden

303
Q

Schrems 2

A

no more privacy shield, facebook ireland

304
Q

Binding corporate rules

A

a company’s rules for internally handling data transfer, don’t apply to data transfers with 3rd parties

305
Q

Article 47, GDPR, before using BCRs

A

it must be certified by a privacy supervisory agency in the EU

306
Q

BCRs must contain the following

A

binding contract rules must contain stuff about, transparency, quality, security, audit, training, compliance procedures, a binding element

307
Q

SCCs

A

standard contract clauses, a company contractually promises to comply with EU law

308
Q

Shrems 2 and SCCs

A

the transferee country equivalent protections as GDPR, the clause and the legal system, or the supervisory authority should suspend the transfer priviledges

309
Q

Codes of Conduct and Certifications

A

have to get approval from an EU data protection authority or the EU commission, the data protection authority has enforcement authority to include suspension

310
Q

Article 49, GDPR, Derogations

A

last resort

311
Q

Shrems 2 , controllers and processors

A

controllers and processors to conduct a transfer impact assessment prior to transferring personal data

312
Q

Transfer impact assessment (TIA) is

A

a risk assessment of transferring data to a third countries, considers SCCs, legal system, adequacy decision stuff

313
Q

European Data Protection Board (EDPB) and 6 steps

A

understand all transfers of personal data, verify all transfer tools, assess if appropriate safeguards will be impinged upon, identify supplemental measures, steps for supplemental measures, re-evaluate the level of protection in the trasferee country

314
Q

Supervisory authority can suspend or end transfers, true or false

A

t

315
Q

Schrems 2, Austrianand French DPAs, Google…

A

Google Analytics violates Chapter V of GDPR, SCCs didn’t provide appropriate safegaurds, US intelligence agencies could access data

316
Q

Privacy operational lifecycle is the cornerstone…

A

cornerstone of privacy program management

317
Q

Privacy operational lifecycle 4 steps

A

discover (assess), build (protect), communicate (sustain), evlove (respond)

318
Q

Privacy operation lifecycle 4 steps more detail

A

(1) Discover/Assess (including “Issue identification and self-assessment” and “Determination of best practices”); (2) Build/Protect (including “Procedure development and verification” and “Full implementation”); (3) Communicate/Sustain (including “Documentation” and “Education”); and (4) Evolve/Respond (including “Affirmation and monitoring” and “Adaptation”)

319
Q

Information Lifecycle Management, Data Lifecycle Management, Data Lifecycle Governance…

A

a policy based approach to managing the flow of information through a lifecycle

320
Q

A privacy notice may also be called a

A

privacy policy, privacy statement, fair processing statement, strictly speaking the notice is internal facing the policy is external facing

321
Q

GDPR requirements are based on …

A

Fair information practices (FIPs)

322
Q

GDPR applies to companies that…

A

have assets and employees in the EU, data stored in the EU, and data interactions with EU residents

323
Q

A company / country may be subject to the GDPR if it processes information…

A

of EU data subjects that access their websites or digital products

324
Q

GDPR fine

A

4% of the company’s global revenue

325
Q

DPAs

A

Data protection authorities ,one in each EU country, but Germany has 1 national and 16 state level, DPAs enforce the GDPR

326
Q

DPAs power

A

investigate, correct, advise; ask for records and proof of compliance, ban/stop/suspend data procecssing, require additional breach notification, order erasing of information, suspend cross boarder data flow

327
Q

GDPR articles 12-14

A

Transparent communication

328
Q

GDPR article 15

A

Right to access

329
Q

GDPR article 16

A

Rectify data

330
Q

GDPR article 17

A

Erasure

331
Q

GDPR article 18

A

Restrict processing

332
Q

GDPR article 19

A

Notification obligation to data subjects about their rights

333
Q

GDPR article 20

A

Data portability

334
Q

GDPR article 21

A

Object to processing personal information

335
Q

GDPR article 22

A

No Automated processing

336
Q

Data Controller is responsible for ensuring Data Subject rights, True or False

A

t

337
Q

Data Controllers to take action on Data Subject requests no later than…

A

30 days after receipt, possible to get an extension of 60 days if the request is burdensome

338
Q

Breach Notification, Data controllers to notify DPAs within how many hours

A

72

339
Q

Breach Notification, Processors notify the Controller within

A

Without undue delay

340
Q

Breach Notification, Controllers notify the Data Subjects within

A

Without undue delay

341
Q

Controllers are exempt from notifying Data Subjects if

A

Data is unintelligible, taken steps to minimize risk, would require disproportionate effort

342
Q

APEC is what

A

Asia Pacific Economic Cooperation, founded in 2004

343
Q

APEC privacy framework is similar to

A

FIPs in APEC is similar to Madrid Resolution

344
Q

APEC privacy framework includes what

A

preventing harm, notice, collection limitation, use of personal information, choice, integrity of information, security safeguards, access, correction, accountability

345
Q

CPEA is what

A

Cross boarder privacy enforcement agreement, APEC

346
Q

Rationalizing

A

multi jurisdiction, key practices to most restrictive laws

347
Q

FTC was founded when

A

1914

348
Q

Why was the FTC founded

A

Antitrust laws

349
Q

Wheeler Lea Act did what to the FTC

A

In 1938 it gave it general consumer protection authority, referred to as Section 5

350
Q

FTC is governed by

A

5 people, a chairperson and 4 commissioners

351
Q

FTC oversees what

A

privacy, fair credit reporting act (FCRA), CAN-SPAM act, COPPA

352
Q

Section 5 of FTC is the most important …

A

most important piece of federal privacy legislation

353
Q

Section 5 states what aboun unfair practices

A

unfair or deceptive acts or practices affecting commerece are unlawful

354
Q

2006 section 5 was ammended for what

A

apply to acts of foreign trade

355
Q

FTC doesn’t apply to whom

A

non-profits, banks, financial institutions, common carriers

356
Q

Magnuson-Moss did what for the FTC

A

permitted it to issue regulations

357
Q

FTC main prosecution method is what

A

To bring enforcement actions

358
Q

FTC hears about stuff how

A

news, public complaints, etc.

359
Q

What is section 6 of the FTC

A

Investigatory powers

360
Q

FTC section 6 has authority to

A

require business to submit written reports, subpoena power

361
Q

FTC pre-complaint is non public, true or false

A

t

362
Q

FTC standard to initiate a complaint

A

If the FTC has reason to believe

363
Q

Respondent defends themselves in front of whom

A

An Administrative Law Judge (ALJ)

364
Q

ALJ will issue what…

A

an injunction, ALJ can not impose civil penalties

365
Q

FTC, how do appeals work

A

ALJ to FTC commissioners to Federal Circuit Court

366
Q

FTC can also do what under 13(a)

A

Prosecute claims before a Federal District Court, review by the Federal Appelate Court

367
Q

Most FTC actions are consent decrees, T or F

A

t

368
Q

Consent decree has the force of a Federal Court Order, T or F

A

t

369
Q

Consent decrees are posted publically T or F

A

TRUE , to provide guidance to other companies

370
Q

Benefits of consent decrees

A

Enforces good practice, avoid expense, easily enforceable, avoid additional negative press, limits exposure to business practices to competitors

371
Q

To establish a deceptive trade practice the FTC needs

A

a material statement or omission that is likely to mislead consumers who are acting reasonably

372
Q

GeoCities

A

first privacy enforcement action, GeoCities sold information

373
Q

Eli Lilly

A

first consent decree, revealed email addresses

374
Q

Snapchat

A

collecting names and phone numbers, and messages didn’t get deleted

375
Q

TrustArc

A

did not conduct annaul re-certifications

376
Q

Nomi

A

tracked consumers via mobile devices

377
Q

LifeLock

A

couldn’t prevent all identity theft

378
Q

Facebook

A

3rd party developers could access user data

379
Q

Zoom

A

weak encryption, secretly installed software

380
Q

To establish an unfair trade pratice the FTC must prove

A

Substantial injury, lack of off setting benefits, and consumers could’t have reasonably avoided

381
Q

DesignerWare

A

log key strokes, take screen shots, photograph anyone with the camera, geo track users

382
Q

Wyndham

A

upheld FTCs unfairness authority, affirmed FTCs authority to regulate cybersecurity

383
Q

Section 18 of the FTC Act

A

rule making authority for unfair or deceptive trade practices, i.e. trade rules

384
Q

LabMD

A

disclosed patient information

385
Q

LabMD v. FTC

A

FTCs cease and desist was unenforceable, FTC started holding public hearings

386
Q

Uber

A

weak security measures

387
Q

Lenovo

A

man in the middel attacks, pre-installing software

388
Q

D-Link

A

exposed routers and web cameras to attack

389
Q

2018 most high profile case

A

Venmo

390
Q

Paypal

A

falsely claimed to have bank grade security

391
Q

BLU products

A

didn’t have appropriate security measures

392
Q

Vtech

A

COPPA violations

393
Q

Equifax

A

didn’t have reasonable security measures

394
Q

Tapplock

A

IoT data and physical security issues

395
Q

SkyMed

A

unsecured cloud storage

396
Q

Ascension Data and Analytics

A

violated GLBA, mortgage information

397
Q

COPPA applies to non profits Tor F

A

False

398
Q

COPPA personal information also includes

A

geolocation data, IP addresses, and info stored in cookies

399
Q

COPPA applies to

A

all operators of commercial websites

400
Q

COPPA notice includes

A

information collected, how used, if info is disclosed to third parties

401
Q

Forms of verifiable consent COPPA

A

mail or fax a consent form, credit card, debit card, call a toll free number, video conference, government issued ID

402
Q

COPPA consent exception

A

collected for the purpose of increasing security

403
Q

COPPA, parental rights

A

access information, withdraw consent

404
Q

COPPA has a safe harbor T or F

A

True, participate in a seal program

405
Q

Two states with laws for children between 13 and 18

A

California and Deleware

406
Q

COPPA, state AG can also prosecute, T or F

A

t

407
Q

Data Broker is what

A

Collect personal information of consumers and resell it

408
Q

Big data

A

Large amounts of data, analyized to get insights on consumer behavior

409
Q

FTC data broker minimization practices

A

2014, data brokers to use data minimzation practices as they relate to children

410
Q

FTC 2016 report on big data

A

Potential harm from inaccurate predictions

411
Q

IoT privacy and security concerns

A

Consumer consent, no UI, need new models of FIPs and security by design

412
Q

HIPPA law orginally for what

A

shift to electronic reimbursement requests, ,efficiency of healthcare

413
Q

HHS rules for administering simplication

A

Privacy rule and the Security rule

414
Q

Privacy and Security rule apply to whom

A

Covered entities and Business associates

415
Q

What is a covered entity

A

A healthcare provider that bills for insurance

416
Q

What is a business associate

A

Any person or entity that receives health information from a covered entity to provide services on behalf of the covered entity

417
Q

What is PHI

A

individually identifiable health information

418
Q

The terms covered entity, business associate, and PHI were codified …

A

In HITECH

419
Q

Minimum necessary requirement

A

limit PHI to the minimum necessary to accomplish the intended purpose

420
Q

Limited data set

A

Data set with facial identifiers removed, 16 categories

421
Q

Patient authorization

A

independent document, plain language, description,person, party, purpose, expire, dated and signed

422
Q

PHI disclosure documentation authorizations

A

Covered entitiy to keep a record, give to the individual upon request

423
Q

PHI disclosure exceptions

A

Emergency, public health activities, report victims of abuse or domestic violence, court, law enforcement, research, investigate compliance

424
Q

PHI privacy notice must be given when

A

date of first service, compliance date, time of enrollment, upon request of the person

425
Q

PHI designated record set

A

Medical, billing, enrollment, any other information used to make decisions

426
Q

PHI right to access records

A

Access the designated record set, except for psychotherapy notes or information collected for a legal proceeding or regulatory action

427
Q

PHI access request timeline

A

within 30 days

428
Q

PHI disclosures accounting timeline

A

can request the last 6 years

429
Q

HIPPA security rule standards

A

ensure CIA, threats, PHI uses or disclosures, ensure compliance

430
Q

Security measure decision criteria

A

the measure’s size, complexity, capabilities, technical infrastructure, cost, risk ocurrance probability, potential risks

431
Q

HIPPA, forms of security rule implementation

A

Required and Addressable

432
Q

HIPAA, privacy and security rule, are contracts between parties mandatory

A

Yes

433
Q

Enforcement of HIPPA privacy and security rules

A

OCR, FTC, DOJ, State Attorneys General

434
Q

HIPPA privacy and security rule, time to fix violations

A

30 days

435
Q

HIPPA preemption, state requests

A

States can request their law is not preempted, have to ask HHS, California Medical Information Privacy Act is an example

436
Q

HIPPA safe harbor

A

A company has recognized security practices in place not less than 12 months

437
Q

Why have a HIPPA safe harbor

A

Give HHS greater discretion imposing fines

438
Q

What is contact tracing

A

Mapping a person’s contact with others, communicable diseases

439
Q

HIPPA doesn’t impact contact tracing, T or F

A

t

440
Q

Biggest things HITECH did

A

Rules for data breaches, increased penalties, gave great acess to records, codified terms

441
Q

Data breach is presumed unless

A

There is a low probability of compromise based on nature and extent of disclosure, who the person was that accessed it, was it acquired or viewed, extent the risk has been mitigated

442
Q

Data breach notice period to affected people

A

60 days

443
Q

Data breach >500

A

Notify media outlets, within 60 days

444
Q

Data breach always notify …

A

Secretary of HHS

445
Q

Data breach notification period extended if…

A

Law enforcement says so

446
Q

HHS oversees GINA, T or F

A

t

447
Q

GINA is PHI under HIPPA, T or F

A

t

448
Q

Cures Act did what

A

Share infor with family and care givers, biomed research confidential, allowed for remote viewing of PHI, no information blocking

449
Q

What is a Part 2 Program

A

Any federally assisted program that provides training or treatement for substance use

450
Q

Substance Use patient record disclosure exceptions, can disclose if..

A

Patient consents, veteran affairs, crimes, child abuse, medical emergency, audits, court order

451
Q

Substance Use patient record use restrictions..

A

can’t use to initiate criminal charges or criminal investigation

452
Q

Part 2 Programs must do..

A

provide notice of rights, formal security program, protect paper and electronic records, destroy records when the company leaves the Part 2 program

453
Q

The FCRA is what

A

Fair credit reporting act

454
Q

FCRA came from where

A

Title VI of FDIC and amended the Consumer Credit Protection Act (CCPA)

455
Q

First federal law protecting personal information from private businesses is..

A

Fair credit reporting act (FCRA)

456
Q

Who the FCRA applies to

A

Any consumer reporting agency (CRA) or users of a consumer report, furnishers of information to the CRA, companies that extend credit - red flags rule

457
Q

What the FCRA applies to

A

Consumer reports

458
Q

What is a consumer report

A

written, oral, or other communication used for eligibility for credit, insurance, employment, character, reputation, mode of living

459
Q

Consumer report exceptions

A

Not a consumer report if it’s transactional, between affiliates, consumer is provided an opt out of affiliate sharing

460
Q

FCRA permissable purpose

A

CRAs can’t share a consumer report unless the user has a permissable purpose

461
Q

FCRA permissable purpose list

A

court order, consumer consent, credit transaction, employment purpose, insurance, gov benefits, assess credit risk, account terms, travle charge cards, child support, liquidation

462
Q

FCRA employment purpose

A

offer, promotion, reassignment, retention

463
Q

FCRA credit transaction purpose

A

consumer consent, firm offer of credit or insurance

464
Q

FCRA firm offer purpose

A

firm offers of credit or insurance, the CRA must maintain a notification system and allow users to opt out

465
Q

FCRA firm offer opt out is good for..

A

5 years

466
Q

FCRA signed notice of election implemented when..

A

must be implemented within 5 business days

467
Q

Can CRAs provide consumer reports with medical information

A

Only if it is coded for insurance purposes

468
Q

Consumer reports with medical information..

A

Users are prohibited from re-disclosing that consumer report

469
Q

FCRA CRAs have to ensure the report is …

A

the consumer report has to be accurate, current, and complete

470
Q

Credit report exclusions

A

Bankruptcy >10 years, other stuff more than 7 years old

471
Q

Credit report exclusions don’t apply if..

A

Don’t apply to credit, life insurance >$150K, employment >$75K salary

472
Q

Credit report must include

A

Bankruptcy chapter, number of credit inquiries, credit account voluntarily closed, any dispute information

473
Q

CRAs are obligated to maintain what..

A

procedures

474
Q

CRA procedures should ensure what..

A

identity of users are validated, consumer reports are accurate

475
Q

CRAs must provide notices to…

A

both uses and furnishers of information

476
Q

Consumer report access 1

A

Consumers have a right to see all the information in their file maintained by the CRA

477
Q

Consumer report access 2

A

Consumers have a right to see everyon their report was given to in the last 2 years for employment, last 1 year for everything else

478
Q

CRAs are required to provide credit score to consumers, T or F

A
479
Q

CRAs are required to provide their sources to consumers, T or F

A
480
Q

Before making any disclosure to a consumer, the CRA must

A

Confirm the consumer’s identity

481
Q

When CRAs make disclosures to a consumer it must..

A

Be in writing, unless consumer consents otherwise, and it must include a summary of the consumer’s rights

482
Q

Consumer files a dispute, CRA must complete their investigation in how many days

A

30 days

483
Q

The FCRA refers to a investigating a consumer dispute as what..

A

A re-investigation

484
Q

CRA provide notice of the consumer dispute to the Furnisher within how many days

A

5 days

485
Q

CRAs must delete information from their files if..

A

The reinvestigation reveals the information was inaccurate, incomplete, or can’t be verified

486
Q

If the CRA deletes information from their file they must do what..

A

Notify anyone who received the consumer report within the last 6 months, or for 2 years if it was for employment purposes

487
Q

CRA re-investigation results must be provided to the consumer within how many days

A

Within 5 days of it being completed

488
Q

CRAs, if a consumer provides a statement of disagreement it must..

A

it must be included in all future consumer reports containing the disputed information

489
Q

When an adverse action it taken against a consumer because of a consumer report what must happen..

A

notice must be given to the consumer

490
Q

When a consumer report adverse action is taken the notice to the consumer must contain

A

The name and contact information of the CRA, a statement the CRA isn’t responsible for and can’t explain anything, their right to request a free copy within 60 days, thei right to protest it

491
Q

Consumer report, adverse action, due to credit score..

A

Consumer to be provided a credit score and information to understand the score

492
Q

Consumer report liability can be avoided if..

A

If reasonable procedures are in place to ensure compliance to the law

493
Q

Consumer report adverse action employment

A

A copy of the report must be given to the consumer along with their rights, before taking action, however, if the consumer submitted the employment application by mail, phone, computer, they don’t need to do this

494
Q

Consumer report adverse action employment, provide notice within how many days

A

within 3 days aftter taking action, and provide name and contact infor of CRA, statement, and how to get a free copy

495
Q

Consumer report reselling

A

Tell the CRA, who the user is, permissable purpose, procedures in place, verify identity and certifications of recipient

496
Q

Limited consumer report is used where

A

For firm offers of credit or insurance not initiated by a consumer, i.e., companies creating a prequalificaiton list for their product or service

497
Q

Companies using limited consumer reports must do what..

A

maintain records of the prescreen criteria for 3 years

498
Q

Consumer report offer solicitation, opt out..

A

CRA file was used, they are credit worthy, service can be withheld if fail further screening, consumer can prohibit (opt out of) similar solicitations by contacting the CRA

499
Q

Consumer report, Furnishers prohibited..

A

From providing false information or innacurate information

Data Privacy (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions