Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CIPP-US > Information Management from a U.S. Perspective > Flashcards

Information Management from a U.S. Perspective Flashcards

18-22 questions

1
Q

Define:

information management

A

establishing, implementing and monitoring the organization’s privacy program under the direction of a senior person in the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

duties of a chief privacy officer

A

developing and implementing policies related to data processing and properly handling of personal information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

duties of a data protection officer

A
  • ensures organization’s processing and handling of personal info is in compliance with legal privacy requirements
  • cannot be directly involved with decision-making regarding data processing activities
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

duties of a privacy engineer

A

works to ensure that compliance with legal requirements has occurred through the technical processes of the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

duties of a privacy manager

A

responsible for development, maintenance and enforcement of privacy policies and procedures within an organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

duties of a privacy analyst

A

manages legal and operational risks related to personal information held by the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

what are the stages of a data life cycle?

A
  1. data creation
  2. data storage
  3. data sharing and usage
  4. data archival
  5. data deletion
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define:

data inventory

A

undertake an inventory of the PI it collects, stores, uses or discloses within the organization and to outside entities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Define:

data classification

A
  • classify data according to its level of sensitivity
  • defines clearance of individuals who can access or handle that data, as well as the baseline level of protection appropriate for that data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Define:

data flow mapping

A

examine and document data flows

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

top-down vs. bottom-up data flow mapping

A
  • top-down: starts with record of processing activities (RoPA) which is required under GDPR
  • RoPA process involves documenting the purpose for processing the PI; parties to whom any PI was disclosed; retention period for PI; and details about the safeguards in place for PI
  • bottom-up: understanding data assets; data inventory and classification; delineating data processes (RoPA); documenting data lineage
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

privacy program should…

A
  • demonstrate effective and auditable framework to enable compliance with applicable privacy laws and regulations
  • promote trust and confidence in the organization’s handling of personal data
  • respond effectively to requests by consumers
  • address privacy and security breaches
  • continually monitor and improve the maturity of the privacy program
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

privacy mission statement

A

describes core function of privacy within the org

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How to ensure appropriate metrics for privacy program framework?

A
  1. identifying intended audience for metrics
  2. defining reporting sources
  3. defining privacy metrics for oversight and governance
  4. identifying systems/application collection points
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the four stages of privacy operatonal life cycle?

A
  1. assess
  2. protect
  3. sustain
  4. respond
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

assess

A
  • document baseline of privacy program
  • evaluate processors and third parties
  • identify operational risks
  • document the assessment
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

protect

A
  • review access controls and technical controls
  • review incident response plan
  • integrate privacy requirements into functional areas of the organization
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

sustain

A
  • monitor and audit compliance with privacy policies
  • monitor regulatory changes
  • hold employee, management and contractor trainings
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

respond

A
  • consumer requests
  • address privacy incidents
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Define:

privacy policy

A

high-level document that helps an organization meet policy goals contained within an org’s privacy vision or mission statement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

typical components of a privacy policy

A
  • purpose
  • scope
  • applicability
  • roles and responsibilities
  • compliance
  • penalties and sanctions for noncompliance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

revision to privacy policy

A
  • according to FTC, companies should obtain express affirmative consent before making material retroactive changes to privacy representations
  • material change at a minimum includes sharing consumer information with 3Ps after committing at the time of collection not to share the data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Define:

privacy notice

A
  • external statement that provides transparency concerning the org’s privacy practices
  • how it collects, uses, shares, retains and discloses PI based on org’s privacy policy
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

organization can communicate privacy notice to consumer by:

A
  • making notice accessible online
  • making notice accessible in places of business
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

layered privacy notice approach

A
  • short notice: top layer that summarizes notice’s scope and basic points about the org’s practice for personal information, collection, choice, use and disclosure
  • full notice: comprehensive information on disclosure that articulates organization’s privacy notice in its entirety
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Define:

just-in-time notice

A

notice at or before point of info collection or before a consumer accepts a service or product

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Define:

privacy dashboard

A

offers a summary of privacy-related info in a format that is intended to be easy to access and navigate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Define:

double or confirmed opt-in

A

consumer first indicates interest in a communication list and then confirms that interest in response to the follow-up email

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

no option to opt

A
  • when an organization uses or collects the consumer’s data because that org has been given implied authority to share PI
  • e.g., a consumer who orders her product online expects her PI to be shared with the shipping company, credit card processor, etc.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

good rule of thumb: channel for marketing should be…

A

chanel for exercising a user preference

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

privacy risk management

A
  • process that identifies and assesses the risk to an org’s information assets and then implements appropriate mitigation strategies to reduce or eliminate those risks
  • often includes conducting PIAs, vendor/third-party risk aseessments, data breach readiness assessments
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Define:

organizational code of ethics

A
  • helps in assessing benefits and risks of processing personal data
  • focuses on topics such as how to respect individuals whose PI held by org; downstream uses of personal data; consequences of utilizing analytical tools; whether to collect data that the org does not need; how should the org design practices to ensure transparency, accountability and auditability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Define:

privacy risk

A

likelihood that individuals will experience problems resulting from data processing, and the impact of these problems should they occur

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Define:

privacy impact assessment

A
  • provides analysis of how personal information is handled to ensure handling conforms to applicable legal, regulatory and policy requirements regarding privacy
  • determine risks and effects of collecting, maintaining and disseminating personal info in identifiable form
  • examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Define:

privacy risk assessment

A
  • core of PIA
  • focuses on determining level of privacy risk by looking at the privacy impact and likelihood given the controls
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

precautions to consider in written contract with third-party vendor

A
  • confidentiality provision
  • no further use of shared information
  • subcontractors should follow privacy and security protection terms in vendor’s K
  • requirement to notify and to disclose breach
  • information security provisions
  • end of relationship → return of data or deletion of data at conclusion of relationship
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

standards for vendor selection

A
  • reputation
  • financial condition and insurance
  • information security controls to ensure data isn’t lost or stolen (e.g., SOC 2)
  • secure transfer mechanisms for data
  • appropriate disposal of information → appropriate destruction of data in any format or media
  • employee training and user awareness
  • vendor incident response
  • org should be able to audit vendor’s activities to ensure compliance with contractual obligations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Define:

information security

A

protection of information for the purpose of preventing loss, unauthorized access, or misuse

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What are the three key attributes of information security?

A
  • confidentiality
  • integrity
  • availability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Define:

confidentiality

A

access to data is limited to authorized parties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Define:

integrity

A

assurance that the data is authentic and complete

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Define:

availability

A

knowledge that the data is accessible, as needed, by those who are authorized to use it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Define:

security controls

A

mechanisms put in place to prevent, detect or correct a security incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What are the three types of security controls?

A
  • physical controls such as locks, security cameras and fences
  • administrative controls such as incident response procedures and training
  • technical controls such as firewalls, antivirus software, and access logs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Define:

NIST Cybersecurity Framework

A

voluntary tool for orgs to better manage and reduce cybersecurity risks with following core elements:

  • identify→ looks at people, systems, data and capabilities to understand what a potential risk could be
  • protect → focuses on safeguards for risks that an organization wants to mitigate
  • detect → activities that identify a cybersecurity incident
  • respond → what activities an org takes when there is an incident
  • recover → plans to restore business operations from a cybersecurity incident
46
Q

Define:

data breach readiness assessment

(include factors)

A

examines level of risk of a data breach coupled with the likelihood and severity of a personal data breach by looking at following factors:

  • types and nature of personal data involved, particularly sensitive personal information
  • whether appropriate technical safeguards have been applied
  • whether the data subject will be directly or indirectly affected
  • possibility that personal data can be maliciously used
  • possibility of substantial damage on a physical level
47
Q

What are mechanisms for cross-border data flows?

A
  • domestic approaches (or unilateral mechanism) → more than ½ of countries with safeguards for cross-border data flows employ pre-authorization safeguards
  • multilateral arrangements such as OECD Privacy Guidelines; APEC Cross-Border Privacy Rules; Council of Europe Convention 108 and 108+
  • trade agreements which may contain provisions
  • standards and technology-driven initiatives such as ISO standards and privacy-enhancing technologies (PETs)
48
Q

When does GDPR apply?

A
  • when EU-based establishments process personal data of any subjects and
  • when establishment based outside of the EU monitors behavior of or targets goods or services to data subjects in the EU
49
Q

Define:

personal data (under GDPR)

A

any data related to an identified or identifiable natural person (can be identified directly or indirectly)

50
Q

Define:

sensitive personal data (under GDPR)

A

special category of personal data that gets additional protections under GDPR and requires the business to obtain “explicit consent” from the person to process the data for a specified purpose

51
Q

Examples of sensitive personal data under GDPR?

A
  • race or ethnic origin
  • political opinions
  • religious or philosophical beliefs
  • trade union membership
  • genetic data
  • biometric data
  • health data, sex life
  • sexual orientation
52
Q

Define:

data subject

under GDPR

A

any natural person whose data is being collected, stored or processed

53
Q

controller

under GDPR

A

individual or entity that determines the purposes and the means of the processing of personal data

54
Q

What are obligations of a controller?

A
  • implement data protection by default and by design
  • provide instructions to processors
  • ensure data security
  • report data breaches
  • cooperate with DPAs
  • appoint a DPO for the business
  • identify legal basis for processing
  • maintain data processing records
  • conduct data protection impact assessments
55
Q

Define

processor

under GDPR

A

an individual or entity that processes personal data on behalf of the controller

56
Q

What are obligations of a processor?

A
  • confidentiality
  • record of processing activities
  • data security
  • data breach reporting
  • cooperation with DPAs
57
Q

Define

consent

under GDPR

A

freely given, specific, informed and an unambiguous indication of the data subject’s wishes

58
Q

For consent to processing of data to be informed, it must contain:

under GDPR

A
  1. controller’s identity
  2. purpose of processing for which consent is sought
  3. types of data that will be collected
  4. information about the right to withdraw consent
  5. information about automated processing
  6. risks of transfers outside the EU
59
Q

Define:

data protection authority

under GDPR

A

independent public authorities that investigate and enforce data protection laws at a national level

60
Q

Define:

data protection officer

under GDPR

A

primary point of contact on data protection issues within a business that is based in the EU

61
Q

What are the seven key principles of GDPR?

A
  1. lawfulness, fairness and transparency
  2. purpose limitation
  3. data minimization
  4. accuracy
  5. storage limitation
  6. integrity and confidentiality
  7. accountability
62
Q

Define:

lawfulness, fairness and transparency

under GDPR

A
  • companies should have a legal basis for processing personal data
  • data subjects should be made aware of the rules and safeguards as well as the risks associated with their data
63
Q

What is considered “transparent” under GDPR?

A

communications must be concise, easily accessible and written using clear and plain language that is easy to understand

64
Q

Define:

purpose limitation

under GDPR

A
  • personal data must be collected for specified, explicit and legitimate purposes
  • personal data shouldn’t be further processed in a manner that is incompatible with the original purpose for which it was collected
65
Q

Define:

data minimization

under GDPR

A
  • processing of personal data must be adequate, relevant and limited to what is necessary considering the purposes of processing
  • requires deletion or anonymization of personal data that is no longer necessary and any data retention period be limited to a strict minimum
66
Q

Define:

accuracy

under GDPR

A

personal data must be accurate and, where necessary, kept up to date

67
Q

Define:

storage limitation

under GDPR

A

personal data must be kept for no longer than is necessary for the purposes of processing

68
Q

Define:

integrity and confidentiality

under GDPR

A

personal data must be processed in a way that ensures a level of security appropriate to the risk of processing the personal data through appropriate technical and organizational measures

69
Q

Define:

accountability

under GDPR

A

controller is responsible for and must be able to demonstrate compliance with the other six principles

70
Q

What are the eight primary data subject rights?

under GDPR

A
  1. right to be informed of transparent communication and information
  2. right of access
  3. right to rectification
  4. right to erase / right to be forgotten
  5. right to restriction of processing
  6. right to data portability
  7. right to object
  8. right not to be subject to automated decision-making
71
Q

How soon must controllers respond to rights requests?

under GDPR

A

within one month of request (or, where necessary, within three months) in writing or, if requested, orally

72
Q

Define:

right to be informed of transparent communication and information

under GDPR

A

privacy notice to provide info

73
Q

Define:

right of access

under GDPR

A

right to obtain following from controllers:

  • confirmation as to whether a controller is processing the data subject’s personal data
  • a copy of the personal data
  • other information that should already be provided in a privacy notice
74
Q

Define:

subject access request

under GDPR

A

when data subjects exercise their right of access

75
Q

Define:

right to rectification

under GDPR

A

allows data subjects to require controllers to confirm the accuracy of their personal data

76
Q

Define:

right to erase (“right to be forgotten”)

under GDPR

A

right to have personal data erased in circumstances where:

  • personal data no longer necessary for purposes collected or otherwise processed
  • data subject withdraws consent on which the processing is based and there is no other legal ground for processing
  • data subject objects to processing based on legitimate interests and no overriding legitimate grounds for the processing
  • personal data was unlawfully processed
  • personal data has to be erased for compliance with a legal obligation
  • personal data has been collected to offer info society services to children
77
Q

What does a controller do if a data subject requests their personal data to be deleted?

under GDPR

A

controller must delete personal data and if has made public data publicly available online, must use reasonable measures to inform other controllers processing the personal data to erase

78
Q

Define:

right to restriction of processing

under GDPR

A

can limit the way their personal data is processed

79
Q

When does the right to restriction of processing apply?

A
  • accuracy of personal data is contested and controller is verifying accuracy
  • processing is unlawful and data subject prefers to have the use of their personal data restricted rather than having it erased
  • controller no longer needs the personal data but the data subject requires it for the establishment, exercise or defense of legal claims
  • data subject has objected to processing pursuant to the GDPR and controller is verifying whether its legitimate grounds override those of the data subject
80
Q

Define:

right to data portability

under GDPR

A

data subjects can port data to themselves or to another controller

81
Q

When does the right to data portability apply?

under GDPR

A

only applies to:
1. personal data provided by data subject
2. where processing based on consent or the performance of a contract
3. when processing carried out by automated means

82
Q

Define:

right to object

under GDPR

A

data subjects can require controllers to stop processing their personal data

83
Q

When can a data subject exercise their right to object?

under GDPR

A

if controller is processing their personal data for:

  • direct marketing purposes
  • on legal basis of legitimate interests
  • on legal basis of task carried out in public interest
  • on legal basis of exercise of official authority
84
Q

Define:

right not to be subject to automated decision-making

under GDPR

A

general prohibition on fully automated decision-making, including profiling, that has a legal or similarly significant effect

85
Q

When can a controller carry out automated decision-making based on processing of personal data?

A

when:
1. necessary for performance of a K between data subject and controller
2. authorized by law or
3. based on data subject’s explicit consent

86
Q

Define:

data breach

under GDPR

A

breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted stored or otherwise processed

87
Q

When does a controller have to report a data breach to a DPA?

under GDPR

A

to relevant DPA within 72 hours of becoming aware where feasible UNLESS unlikely to result in risk to individuals’ rights and freedoms

88
Q

Define

aware

under GDPR related to breach

A

have reasonably degree of certainty that a security incident has compromised personal data

89
Q

When does a controller have to report a data breach to data subjects?

under GDPR

A

if data breach occurs that is likely to result in high risk to individuals’ rights and freedoms, then without undue delay

90
Q

What should be contained in the controller’s notice to data subjects of a data breach?

under GDPR

A

notice must be in clear and plain language and must include name and contact of the DPO, likely consequences of the data breach, and any measures taken by controller to mitigate the risk

91
Q

How can a data subject take action?

under GDPR

A
  • initiate administrative complaint
  • go to national court (if unsatisfied with decision of DPA or DPA doesn’t inform give update on complaint within three months)
  • seek judicial remedy
92
Q

How is the complaint process initiated?

under GDPR

A

can be initiated by data subject or by DPA

93
Q

What does a DPA do with a complaint?

under GDPR

A
  1. assessment to determine lead DPA (if more than one DPA has complaint)
  2. assess to determine whether to impose adminisrtative fine
94
Q

liability of processor vs. controller

under GDPR

A

each is liable for entire damage if both involved in same processing and once data subjects compensated, then they can get comp from each other

95
Q

higher-level fines

under GDPR

A

greater of 20 mil Euros or 4% of global annual revenues

96
Q

lower-level fines

under GDPR

A

greater of 10 mil Euros or 2% of global annual revenues

97
Q

What do higher-level fines cover?

under GDPR

A

infringements related to basic principles of processing, rights of data subject and transfers of personal data to a recipient outside EU

98
Q

Define:

European Economic Area

A

EU and Norway, Liechtenstein and Iceland

99
Q

What is required for data transfers from the EEA to non-EEA countries?

A

prohibited unless can rely upon adequacy decision, appropriate safeguard or a derogation

100
Q

Define:

adequate transfer

international data transfers

A

data transfer to a country that has adopted protections that the EU law deems “adequate” (essentially equivalent to those found in the GDPR)

101
Q

Define:

appopriate safeguard

international data transfers

A
  • legally binding and enforceable instrument between public authorities or bodies
  • binding corporate rules
  • standard contractual clauses
  • standard data protection clauses adopted by European Commission
  • standard data protection clauses adopted by a DPA and approved by European Commission
  • approved code of conduct, together with binding and enforceable commitments of the non-EEA controller or processor
  • approved certification mechanism together with binding and enforceable commitments of non-EEA controller or processor
  • contractual clauses authorized by DPA or of the controller/processor transferring the data outside the EEA
  • administrative arrangements between public authorities authorized by the DPA in the country from which the transfer is made
102
Q

Define:

binding corporate rules

international data transfers

A

provide that a multinational company can transfer data between countries, including among affiliated entities, after certification of its practices by a DPA

103
Q

Define:

standard contractual clause

international data transfers

A

company contractually promises to comply with EU law and to submit to supervision of a DPA

104
Q

define

derogations

international data transfers

A

allow for a transfer if the data subject has provided explicit consent to the transfer or if the transfer is necessary for one of following:

  • performance of K between data subject and controller and transfer is occasional
  • performance or conclusion of a K concluded in interest of data subject between controller and 3P and transfer is occasional
  • important reasons of public interest
  • establishment, exercise or defense of legal claims and the transfer is occasional
  • protection of vital interests of an individual incapable of giving consent
105
Q

Define:

last-resort derogation

international data transfers

A

transfer can take place if necessary for purposes of compelling legitimate interest and meets all of specified requirements under the GDPR

106
Q

history of data transfers from EU to U.S.

A
  1. Safe Harbor program under EU Data Protection Directive until 2015
  2. Schrems I case (2015)
  3. Privacy Shield (2016)
  4. Schrems II case (2020)
  5. Data Privacy Framework finalized in July 2023
107
Q

Schrems I case (2015)

A

CJEU struck down Safe Harbor program

108
Q

Schrems II case (2020)

A

CJEU struck down Privacy Shield and raised concerns about perceived lack of legal protection from U.S. government surveillance for EU data being transferred to Facebook

109
Q

key points of EU-U.S. Data Privacy Framework

A

U.S. agreed to ensure that surveillance activities would comply with the “necessity and proportionality” standard and to establish an independent data protection review court to provide European citizens the ability to complain when they believe their personal data has been collected inappropriately by U.S. intelligence agencies/U.S. designed EU and member states as qualifying states

110
Q

recent developments in global data flows

A
  • APEC issued declaration concerning an international approach to allow trade between participating countries while providing assurances how data will be handled
  • Global Cross-Border Privacy Rules Forum: establishment of international certification system based on existing APEC Cross-Border Privacy Rules and Privacy Recognition for Processors (PRP) Systems announced in 2022
  • OECD adopted a declaration on common principles for government access, both for law enforcement and national security purposes, to personal data held by private companies

CIPP-US (17 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions