IAPP Glossary for CIPP/E Flashcards
Accountability
Afair information practicesprinciple, it is the idea that whenpersonal informationis to be transferred to another person or organization, the personal information controller should obtain the consent of the individual or exercise due diligence and take reasonable steps to ensure that the recipient person or organization will protect the information consistently with other fair use principles.
Adequate Level of Protection
A label that the EU may apply to third-party countries who have committed to protect data through domestic law making or international commitments. Conferring of the label requires a proposal by theEuropean Commission, anArticle 29 Working GroupOpinion, an opinion of the article 31 Management Committee, a right of scrutiny by theEuropean Parliamentand adoption by the European Commission.
Adverse Action
Under theFair Credit Reporting Act, the term “adverse action” is defined very broadly to include all business, credit and employment actions affecting consumers that can be considered to have a negative impact, such as denying or canceling credit or insurance, or denying employment or promotion. No adverse action occurs in a credit transaction where the creditor makes a counteroffer that is accepted by the consumer. Such an action requires that the decision maker furnish the recipient of the adverse action with a copy of the credit report leading to the adverse action.
Annual Reports
The requirement under theEuropean Data Protection Directivethat member state data protection authorities report on their activities at regular intervals.
Antidiscrimination Laws
Refers to the right of people to be treated equally.
Article 29 Working Party
AEuropean Unionorganization that functions as an independent advisory body on data protection and privacy. While EU data protection laws are actually enforced by the nationalData Protection Authoritiesof EU member states.
Authentication
The process by which an entity (such as a person or computer system) determines whether another entity is who it claims to be. Authentication identified as an individual based on some credential; i.e. a password,biometrics, etc. Authentication is different fromauthorization. Proper authentication ensures that a person is who he or she claims to be, but it says nothing about theaccess rightsof the individual.
Background Screening/Checks
Verifying an applicant’s ability to function in the working environment as well as assuring the safety and security of existing workers. Background checks range from checking a person’s educational background to checking on past criminal activity.
Behavioral Advertising
The act of tracking users’ online activities and then delivering ads or recommendations based upon the tracked activities. The most comprehensive form of targeted advertising. By building a profile on a user through their browsing habits such as sites they visit, articles read, searches made, ads previously clicked on, etc., advertising companies place ads pertaining to the known information about the user across all websites visited. Behavioral Advertising also usesdata aggregationto place ads on websites that a user may not have shown interest in, but similar individuals had shown interest in.
Binding Corporate Rules
Legally binding internal corporate privacy rules for transferring personal information within a corporate group. BCRs are typically used by corporations that operate in multiple jurisdictions, and they are alternatives to theU.S.-EU Safe Harborand Model Contract Clauses. BCRs must be approved by the EUdata protection authoritiesof the member states in which the corporation operates.
Binding Safe Processor Rules
Self-regulatory principles (similar toBinding Corporate Rules) for processors that are applicable to customer personal data. Once a supplier’s BSPR are approved, a supplier gains ”safe processor” status and its customers would be able to meet theEU Data Protection Directive’srequirements for international transfers in a similar manner as BCR allow. BSPR are currently being considered as a concept by theArticle 29 Working Partyand national authorities.
Biometrics
Data concerning the intrinsic physical or behavioral characteristics of an individual. Examples include DNA, fingerprints, retina and iris patterns, voice, face, handwriting, keystroke technique and gait.
Bodily Privacy
One of the four classes of privacy, along withinformation privacy,territorial privacyandcommunications privacy. It focuses on a person’s physical being and any invasion thereof. Such an invasion can take the form of genetic testing, drug testing or body cavity searches.
Breach Disclosure
The requirement that adata controllernotify regulators and victims of incidents affecting theconfidentialityand security ofpersonal data. It is a transparency mechanism highlights operational failures, this helps mitigate damage and aids in the understanding of causes of failure.
Bundesdatenschutzgesetz
A German national data protection law that including specific requirements for data services outsourcing agreements. The legislation contains ten specific requirements for outsourcing agreements: (1) Subject and duration of work; (2) the extent, type and purpose of data processing; (3) technical and organizational measures to be taken under section 9; (4) the rectification, erasure and blocking of data; (5) the processor’s section 4 obligations, particularly with regard to monitoring; (6) rights regarding subcontracting; (7) the controller’s monitoring rights; (8) the subcontractor’s notification obligations; (9) the extent of the controller’s authority to issue instructions to the processor; (10) the return and/or erasure of data by the processor at the conclusion of the work.
Charter of Fundamental Rights
A treaty that consolidates human rights within theEU. The treaty states that everyone has a right to protect theirpersonal data, that data must be processed for legitimate and specified purposes and that compliance is subject to control by an authority.
Children’s Online Privacy Protection Act (COPPA) of 1998
A U.S. federal law that applies to the operators of commercial websites and online services that are directed to children under the age of 13. It also applies to general audience websites and online services that have actual knowledge that they are collecting personal information from children under the age of 13. COPPA requires these website operators: to post aprivacy policyon the homepage of the website; provide notice about collection practices to parents; obtain verifiable parentalconsentbefore collecting personal information from children; give parents a choice as to whether their child’spersonal informationwill be disclosed to third parties; provide parents access and the opportunity to delete the child’s personal information andopt outof future collection or use of the information, and maintain theconfidentiality, security and integrity of personal information collected from children.
Choice
An individual’s ability to determine whether or how theirpersonal informationmay be used or disclosed by the entity that collected the information. Also, the ability of an individual tolimitcertain uses of their personal information. For example; an individual may have choice about whether to permit a company to contact them or share their data with third parties. Can be express or implied.
Closed Circuit Television
Systems of cameras, monitors and recording equipment that are not used for broadcasting but are connected to a closed network by cables. CCTV is used primarily forvideo surveillanceof premises.
Cloud Computing
The storage of information on the Internet. Although it is an evolving concept, definitions typically include on-demand accessibility, scalability, and secure access from almost any location. Cloud storage presents unique security risks.
Collection Limitation
Afair information practicesprinciple, it is the principle stating there should be limits to the collection ofpersonal data, that any such data should be obtained by lawful and fair means and, where appropriate, with the knowledge orconsentof the data subject.
Commercial Activity
UnderPIPEDA, “commercial activity” means any particular transaction, act or conduct, or any regular course of conduct, that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists. Non-profit associations, unions and private schools are likely to be found to exist outside of this definition.
Communications Privacy
One of the four classes of privacy, along withinformation privacy,bodily privacyandterritorial privacy. It encompasses protection of the means of correspondence, including postal mail, telephone conversations, electronic e-mail and other forms of communicative behavior and apparatus.
Comprehensive Laws
Laws that govern the collection, use and dissemination ofpersonal informationin the public and private sectors.
Computer Forensics
The discipline of assessing and examining an information system for relevant clues even after it has been compromised by an exploit.
Confidentiality
The obligation of an individual, organization or business to protect personal information and not misuse or wrongfully disclose that information.
Consent
This privacy requirement is one of thefair information practices. Individuals must be able to prevent the collection of theirpersonal data, unless the disclosure is required by law. If an individual has choice (seeChoice) about the use or disclosure of his or her information, consent is the individuals’ way of giving permission for the use or disclosure. Consent may be affirmative; i.e.,opt-in; or implied; i.e., the individual didn’topt out. (1) Explicit Consent: A requirement that an individual “signifies” his or her agreement with a data controller by some active communication between the parties. According to theEU Data Protection Directive, explicit consent is required for processing of sensitive information. Further,data controllerscannot infer consent from non-response to a communication. (2) Implicit Consent: Implied consent arises where consent may reasonably be inferred from the action or inaction of the individual.
Convention 108
The first legally binding international instrument in the area of data protection. It requires signatories to take steps to ensure fundamental human rights with regard to the processing of personal information.
Cookie
A small text file stored on a client machine that may later be retrieved by a web server from the machine. Cookies allow web servers to keep track of the end user’s browser activities, and connect individual web requests into a session. Cookies can also be used to prevent users from having to be authorized for every password protected page they access during a session by recording that they have successfully supplied their user name and password already. Cookies may be referred to as “first-party” (if they are placed by the website that is visited) or “third-party” (if they are placed by a party other than the visited website). Additionally, they may be referred to as “session cookies” if they are deleted when a session ends, or “persistent cookies” if they remain longer.
Cookie Directive
Additions to the e-Privacy Directive where websites could allow users to opt out of cookies, such as by selecting a setting on their web browsers. Under the revision, member states are required to pass legislation that gives users the ability to opt in before cookies are placed on their computers.
Copland v. United Kingdom
A case in which theEuropean Court of Human Rightsheld that monitoring an applicant’s e-mail at work was contrary to Article 8 of the Convention on Human Rights.
Council of the European Union
The main decision-making body of theEU, it has a central role in both political and legislative decisions. The council was established by the treaties of the 1950s, which laid the foundations for the EU.
Court of Justice of the European Union
The Court of Justice is the judicial body of theEUthat makes decisions on issues of EU law and enforces European decisions either in respect to actions taken by theEuropean Commissionagainst a member state or actions taken by individuals to enforce their rights under EU law. The court is the judicial body of the EU that makes decisions on issues of EU law and enforces European decisions. Based in Luxembourg, the Court was set up in 1951, and was originally named the Court of Justice of the European Communities. The court is frequently confused with theECHR, which oversees human rights laws across Europe, including in many non-EU countries, and is not linked to the EU institutions.
Customer Access
A customer’s ability to access thepersonal informationcollected on them as well as review, correct or delete any incorrect information.
Customer Information
In contrast toemployee information, customer information includes data relating to the clients of private-sector organizations, patients within the healthcare sector and the general public within the context of public-sector agencies that provide services.
Data Breach
The unauthorized acquisition of computerized data that compromises the security,confidentiality, or integrity ofpersonal informationmaintained by a data collector. Breaches do not include good faith acquisitions of personal information by an employee or agent of the data collector for a legitimate purpose of the data collector—provided the personal information is not used for a purpose unrelated to the data collector’s business or subject to further unauthorized disclosure.
Data Controller
An entity that has the authority over the processing ofpersonal information. This entity is the focus of most obligations under privacy and data protection laws. It controls the use of personal data by determining the purposes for its use and the manner in which the data will be processed. The data controller may be an individual or an organization that is legally treated as an individual, such as a corporation or partnership.
Data Elements
The different types ofpersonal informationprocessed bydata processors. Typical data elements include name, date of birth and numerical identifiers. Organizational data elements tied to both individuals as well as organizations include business addresses, business phone numbers, business e-mail addresses and related information.
Data Processing
Any operation or set of operations which is performed onpersonal data, such as collecting; recording; organizing; storing; adapting or altering; retrieving; consulting; using; disclosing by transmission, dissemination or otherwise making the data available; aligning or combining data, or blocking, erasing or destroying data. Not limited to automatic means.
Data Processor
An individual or organization that processes data on behalf of thedata controller. Although they are oftenthird-party providers, a data controller can also be a data processor.
Data Protection Authority
An official or body that ensures compliance with data protection laws and investigates alleged breaches of the laws’ provisions.
Data Protection Commissioner
The person responsible for the enforcement and monitoring of compliance with data protection legislation, including Data Protection Acts. Commissioners are also responsible for investigating breaches of the legislation and prosecuting the senders of spam e-mails and text messages pursuant to SI 535/2003. Only one such prosecution has occurred to date. In the UK, this function is carried out by the Information Commissioner.
Data Protection Directive
See EU Data Protection Directive
Data Quality
A fair information practices principle, it is the principle thatpersonal datashould be relevant to the purposes for which it is to be used, and, to the extent necessary for those purposes, should be accurate, complete and kept up-to-date. The quality of data is judged by four criteria: Does it meet the business needs?; Is it accurate?; Is it complete?, and is it recent? Data is of an appropriate quality if these criteria are satisfied for a particular application.
Data Recipient
A natural or legal person, public authority, agency or any other body which processespersonal dataon behalf of thedata controller.
Data Retention Directive
This directive is designed to align the rules on data retention across theEUmember states. It applies to traffic and location data but not to the actual content of communications of both individuals and organizations.
Data Subject
The individual about whom information is being processed, such as the patient at a medical facility, the employee of a company or the customer of a retail store.
De-identification
An action that one takes to remove identifying characteristics from data. De-identified data is information that does not actually identify an individual.Some laws require specific identifiers to be removed (SeeHIPAA 165.514(b)(2)).Hashingis not enough to de-identify data
Derogation
The action by which anEUmember state may deviate from certain directives, instead relying upon the domestic laws of member states.
Direct Marketing
When the seller directly contacts an individual, in contrast to marketing through mass media such as television or radio.
Do Not Track
A proposed regulatory policy, similar to the existingDo Not Call Registryin the United States, which would allow consumers toopt outof web-usage tracking.
Durant v. Financial Services Authority
A court case in which the Court of Appeal of the United Kingdom narrowed the definition of personal data. It established a two-stage test; the information must be biographical in a significant sense and the individual must be the focus of the information.
Electronic Communications Data
Consists of three main categories of personal data: the content of a communication,traffic data, and location data.
Electronic Communications Network
Transmission systems, and, where applicable, switching or routing equipment and other resources that permit the conveyance of signals by wire, radio, optical or other electromagnetic means, including satellite networks; fixed and mobile terrestrial networks; electricity cable systems, to the extent that they are used for the purpose of transmitting signals; networks used for radio and television broadcasting, and cable television networks, irrespective of the type of information conveyed.
Electronic Communications Service
Any service which provides to users thereof the ability to send or receive wire or electronic communications.
Employee Personal Data
A high level of protection is required for employeepersonal datain theEU. The notice and choice principles of theEU Directiveshould be honored for all employee data, meaning that an employee should be given notice of the company’s intent to share the information and give the employee the choice not to share this information.
Encryption
The process of obscuring information, often through the use of acryptographicscheme in order to make the information unreadable without special knowledge; i.e., the use of code keys.
