Government And Court Sccess To Private Section Information Flashcards
Bank secrecy act of 1970 or BSA
Authorizes the US treasury secretary to issue regulations that impose extensive record keeping and suspicious reporting requirements on financial institutions. Must keep records and files on reports on certain financial transactions including currency transactions in excess of 10K which may be relevant to criminal tax or regulatory proceedings
What are some examples of Required disclosure of personal data by law
Bank secrecy act - money laundering
Us food and drug administration - requires health professionals and drug manufacturers to report serious adverse events product problem etc
OSHA- reporting information about workplace injuries
States require reporting of certain types of injuries (abuse, gunshot wounds, immunization records)
Examples of disclosures permitted by not required by law
HIPAA permits but does not require companies to disclose PHI when required to do so by a state law that may require reporting of medical information. Also for public health, law enforcement, and national security
USA patriot act permits but does not require the owner of a computer system to provide access to their computer if
- the owner authorized it
- the person requesting is engaged in the investigation
- the interception does not require communications other than those transmitted
- the person requesting has reasonable grounds to believe the contents are relevant to the investigation
Examples of disclosure forbidden by law
HIPAA and COPPA Gramm-leach Bailey act For investigations and litigation evidentiary privileges can also prohibit disclosures -attorney client privilege - doctor patient - spouse - person accused of the crime
Wiretaps
Federal law is strict in prohibiting wiretaps of telephone calls, under federal law interception is permitted if one of the parties has given consent.
Interception of these communications is a criminal offense and provides a private right of action.
Many states have strict rules that all of the parties to the call must consent ( this call is being recorded for quality assurance example)
Another exception is if the interception is done in the ordinary course of business ( if the employer provides the phone or email service, and monitoring is done in the normal business hours.. call center or scanning emails for malware)
Federal law is not preemptive to state laws
Stored records
The stored communication act (SCA) crested a general prohibition against the unauthorized acquisition alteration or blocking of electronic communications while in electronic storage in a facility through which an electronic communication service is provided
Many states require notice be provided to an employer who engages in any type of electronic monitoring
Pen registers
Pen registers recorded the telephone numbers of outgoing calls
Trap and trace recorded the telephone numbers that called into a particular number
ECPA allowed for pen registers and trap and trace records from a judge if relevant to an ongoing investigation
CALEA
The communications assistance to law enforcement act
Also known as the digital telephony act
Implanted by the FCC
Requires telecommunications carriers to cooperate in the interception of communications for law enforcement and other needs relating to the security and safety of the public to
Requires them to design their products and services to ensure they can carry out lawful order to provide government access to communications
Includes telecommunication carriers, providers of broadband internet access, and voice over internet protocol.
CISA
Cyber security information sharing act
Participation by companies is voluntary and provisions includes:
- authorization for a company to share or receive cyber threat indicators or defensive measures
- requirement for company to remove personal information before sharing
- sharing information with federal government does not waive privileges
- shared information exempt from federal and state FOIA laws
- prohibition on government using shared information to regulate or take enforcement actions against lawful activities
- authorization for companies monitoring and operating defensive measures
- protection from liability for monitoring activities
Right to financial privacy act of 1978
No government authority may have access to or obtain copies of or the information contained in the financial records of any customer from a financial institution unless the financial records are reasonably described and meet at least one of these conditions:
- the customer authorizes access
- there is an appropriate administrative subpoena or summons
- there is a qualified search warrant
- there is an appropriate judicial subpoena
- there is an appropriate formal written request from an authorized government authority
Privacy protection act (PPA)
Provides an extra layers of protection for members of the media and media organizations from government searches or seizures in the course of a criminal investigation
Government officials engaging in criminal investigations are not permitted to search or seize media work products or documentary materials reasonably believed to have a purpose to disseminate to the public
Requires law enforcement to use a subpoena or voluntary cooperation to obtain evidence
Applies to government and only to criminal investigations not civil.
FISA
Foreign intelligence surveillance act
Establishes standards and procedures for electronic surveillance that collects foreign intelligence within the US
FISA orders can occur when foreign intelligence gathering is a significant purpose of the investigation
FISA orders occur based on probable cause that the party to be monitored is a foreign power
Can request wiretaps, pen registers and trap and trace orders and order video surveillance
No disclosures are required to the target, but companies can publish how many orders they have received
National security letters
A category of subpoena
Used to seek records relevant to protect against international terrorism or clandestine intelligence activities.
Can be issued without any judicial involvement
Recipients can petition to modify or set aside an NSL if compliance would be unreasonable or oppressive
Recipients of NSLs are bound to confidentiality only if there is a finding by the requesting agency of interference with a criminal or counterterroisim investigation
Recipients can disclose the request to those necessary to comply and to an attorney for legal assistance
Recipients can petition a court to modify or end the secrecy requirement
Breach of confidentiality are punishable up to 5 years in prison and fines up to 250k
USA freedom act
Sets new rules for national security investigations prohibiting the use of pen registers and trap and trace orders for bulk collection and restricting their use to circumstances where there were specific selectors such as an email address or telephone number
Ended bulk collection conducted under section 215 of the USA patriot act
Company officials are now permitted to release statistics about the number of requests received in a given time period and the government is required to report its numbers increase a year
Was passed in response to the Snowden revelations
Created a group on independent experts in the area of privacy and civil liberties called amicus curiae to brief the FISC on novel or significant matters of law
USA patriot act
Made changes to Anti money laundering laws - implemented know your customer requirements to deter money laundering
Expanded definition of pen registers and trap and trace orders to include dialing, routing, addressing, or signaling information transmitted to or from a device or process
Provided the flexibility to use foreign intelligence wiretaps more often and with flexible legal limits
Section 215 allows a federal court to require production of any tangible thing for defined foreign intelligence and anti terrorism investigations
Expanded the use of NSLs and had strict rules against disclosing that an organization has received an NSL
