Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CIPP Exam > Introduction to privacy > Flashcards

Introduction to privacy Flashcards

1
Q

How do you define privacy?

A

The right to be let alone, an individuals right to control the collection, use and disclosure of personal information. Also includes the right to keep personal information private.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

what are fair information practices?

A

set of guidelines for handling, storing, protecting and managing personal information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what are the four categories of FIPs (CRIM)

A
  1. controls of the information(information security, information quality)
  2. rights of individuals- notice, choice and consent, data subject access
  3. information life cycle- collection, use and retention, disclosure, destruction
  4. management- management and administration, monitoring, and enforcement
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

what states have privacy laws?

A

Virginia, California, Utah and Colorado

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the definition of personal information?

A

any information relating to an identified or identifiable living individual.
note: applies to both electronic and paper records.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

what are examples of personal information?

A

name, gender, address, telephone number, email address, martial status

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

what is sensitive information examples

A

SSN number, financial information, driver’s license number, medical records.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

what is the definition of sensitive information?

A

data that is more significantly related to the notice of a reasonable expectation of privacy, such as medical or financial information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

When does personal information become non-personal?

A

when the information is anonymized to the point that the associated individual can no longer be identified.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

T or F unless personal information is truly anonymized, privacy and data protection laws still apply

A

true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is pseudonymized data?

A

data that has been processed in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information

For example: hashing, using blockchain, differential privacy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are sources of personal information on a data subject?

A

public records, publicly available information, nonpublic information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what is non public information

A

information not easily accessible due to law or custom(e.g. medical records, financial information, adoption records.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

T or false, the same information may be public record publicly available and nonpublic

A

T

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

what is a data subject?

A

an individual about whom information is being processed (e.g. employee, consumer, patient)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

what is a data controller?

A

an organization or individual with the authority to decide how and why information about data subjects is to be processed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

what is a data processor

A

an organization or individual that processes data on behalf of the data controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

what is a data protection authority?

A

supervisory authority chartered to enforce privacy or data protection laws and regulations (DPA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Does the U.S have a national data protection authority ?

A

No., but the FTC, state attorney generals, federal financial regulators play a role

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Hypo: Identify who fulfills each role in the following scenario

Jim is employed by ABC company. The HR department keeps much of his personal data on file, and it contracts with a payroll company that directly deposits Jim’s paychecks into his bank account.

who is the data subject? data controller and data processor?

A

Jim- data subject
ABC company- data controller
HR company- data processor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Name ways to protect personal information

A

Markets, technology, law, self regulation/co-regulation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Name the privacy protection models

A
  1. few or no laws(Cuba)
  2. co-regulatory (Australia)
  3. sectoral- covers industry specific laws -(U.S.)
  4. Comprehensive omnibus laws- EU
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

what are the branches of the U.S. Government

A

executive, legislative, judicial

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

T or F? state constitutions may create stronger privacy rights that the federal constitution?

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

what is a consent decree/order in a data privacy context

A

an agreement or settlement that resolves a dispute between a regulator and a private party without admission of guilt or liability. It also describes the actions the defendant will take(e.g. defendant agrees to stop alleged illegal activity)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

T or F- the FTC can assess fines directly in consent orders or decrees?

A

No, the matter must go to court

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Does CAN-SPAM supersede a stricter state law?

A

Yes. it prempts a stricter state law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

what is a privacy notice

A

a description of an organizations information management practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

what is the initial mechanism used by regulatory agencies to determine if a controller or a processor is complying with the law and with the organizations own privacy commitments?

A

privacy notices do this. privacy notices help data subjects enforce their rights

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

what is another name for a privacy notice?

A

privacy policy or privacy statement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

what must a privacy notice include 4 things? (DEWI)

A
  1. Description of what information is collected
  2. how the information is used and disclosed,
  3. how to exercise any choices about uses or disclosures
  4. whether the individual can access or update the information
32
Q

what is choice in a data privacy context?

A

the ability to specify whether personal information will be collected and/or how it will be used or disclosed.

E.g.- opt in, or opt out

33
Q

what is “opting in”

A

individual actively gives consent (express consent) to the use of their data

34
Q

what is “opt out”

A

consent assumed unless the affected individual specifically withdraws consent (implied consent)

35
Q

what is access in a privacy context

A

the ability to view personal information held by an organization.

36
Q

What is the GDPR?

A

General data protection regulation

37
Q

who does the GDPR apply to?

A

The GDPR applies to all organizations who do business in the EU

38
Q

T or F? Does the GDPR apply to nonprofits and for profit organizations?

A

It applies to both.

39
Q

how many days after a data breach must the breach be reported under the GDPR?

A

72 hours.

40
Q

what fines are associated with the GDPR?

A

2 percent of annual global revenue or up to 10 million euros of revenue per infraction, whatever is higher.

41
Q

What are the data subjects rights under the GDPR? ARE-RDO

A

Access to personal data
rectification of inaccurate information
erasure- have personal data erased and no longer processed
restriction of processing- object to data processing of legitimate interests
data portability- receive their personal data in a structured, commonly used machine readable format
no profiling-

42
Q

how is personal data defined under the GDPR?

A

any information related to an identified or identifiable natural person

43
Q

Does the GDPR apply whether the organization or individual processing the personal data is physically located in the EU or not

A

Yes, it still applies

44
Q

Yes or no,

Must data under the GDPR be processed by wholly or partly by automated means?

A

Yes

45
Q

what is the material scope of the GDPR

A

data must be processed in part or in whole by automated means, personal data which forms a part of a filing system, exclusions. (including activities outside of the scope of the EU

46
Q

what are mechanisms for the lawful transfer of personal data from the EU to the US under the GDPR?

A

Binding corporate rules and standard contractual clauses, codes of conduct

47
Q

What are the recommended steps for global data flows?

A
  1. map your transfers
  2. verify that the transfer tool relied on is on the approved list under Chapter V of the GDPR
  3. Assess the sufficiency of non-EEA protections
  4. identify and adopt supplementary measures
  5. take formal procedural steps
  6. re-evaluate at appropriate intervals.
48
Q

What is a data protection officer under the GDPR?

A

a staff member or contractor tasked with

  1. advising the controller or processor,
  2. facilitating communications with applicable supervisory authorities,
  3. engaging with data subjects, monitoring and testing the controller or processors compliance with EU data
49
Q

T or F the DPO does not have to be an expert in data protection law and pratices

A

false

50
Q

when is a DPO a required role?

A

when processing large scale monitoring of data subjects, processing sensitive data or criminal convictions/offenses on a large scale, processing by public bodies

51
Q

what is the California consumer Privacy Act

A

law that provides a comprehensive regime of consumer privacy rights similar to those found in data protection laws outside the US.

52
Q

when did the CCPA’s general regulations go into effect?

A

August 14, 2020

53
Q

T or F, the CCPA only applies to commercial entities

A

T

54
Q

what businesses are covered under the CCPA? Must meet at least one

A
  1. for-profit businesses (and non profits that co-brand with a for profit) that does more than 25 million USD in annual revenue
  2. holds the personal information of 50k people, households or devices(e.g. website visitors)
  3. derives 50 percent or more of its annual revenues from selling consumer’s personal information
55
Q

how is personal information defined under the CCPA?

A

any information that relates to a particular consumer or household.
note: includes more than a specific individual

56
Q

who are protected individuals under the CCPA

A

any consumer - defined as a natural person who is a California resident, including those in the state for a temporary or transitory purpose OR those domiciled in the state and currently outside of the state temporarily

57
Q

What are consumer rights under the CCPA? (NA-ORD)

A

Notice, access, opt-out, right of erasure, right to to not be discriminated against

58
Q

T or F under the CCPA, consumers b/t the ages of 13-16 must affirmatively opt in to authorize the sale of their personal info

A

T

59
Q

What must businesses do under the CCPA

A
  1. provide disclosures to consumers
  2. provide the info free of charge within 45 days in a portable format
  3. include a do not sell my personal information link on website
  4. provide a method to receive consumer requests(e.g. a 800 number, web form, etc)
  5. have a verification process so consumers can prove their identity
  6. train employees
  7. disclose to consumers the third parties to whom the business sells PI
60
Q

how is the CCPA enforced?

A
  1. enforced by the state attorney general- $2500 fine per violation addressed within 30 days
    $7500 fine per record for intentional violations not addressed within 30 days
  2. private right of action
61
Q

what is the CPRA?

A

AMENDS AND EXPANDS ON THE CCPA- REQUIRES THE ESTABLISHMENT OF AN ENFORCEMENT AGENCY TO IMPLEMENT AND ENFORCE CONSUMER PRIVACY LAWS

62
Q

when is the CPRA enforceable?

A

January 1, 2023

63
Q

what are the steps to develop a privacy program for a company?

A
  1. Discover- identify issues and best practices, perform self assessments.
  2. Build- policies and inventories
  3. Communicate- effective communication to employees and contractors
  4. Evolve- process for review and update-
64
Q

what is meant by “opting in”

A

affirmative consumer consent to data collection or use

note: usually by requiring the data subject to confirm their choice via a response to a follow up email

65
Q

what is meant by “opt out”

A

when consent is assumed unless the consumer specifically denies consent(e.g. unchecks a box)

66
Q

T or F- an organization should have retention policies that limit the time that PI is stored

A

True

67
Q

what is FACTA

A

the fair and accurate credit transactions act

68
Q

T or F FACTA preempts most stricter state laws

A

T

69
Q

what entities are covered under HIPPA?

A

healthcare providers, health plans(insurers) and clearinghouse(where records are stored)

70
Q

T or F HIPPA pre-empts stricter state laws

A

False

71
Q

what is the maximum fine under HIPAA?

A

1.7 MILLION

72
Q

T or F- entities covered under HIPAA must designate a privacy official who is responsible for the development and implementation of privacy protections

A

T

73
Q

what is the notification period under the HIPAA notification rule

A
  1. affected individuals must be notified within 60 days of the breach
  2. the media(if more than 500 people affected)
  3. HHS secretary- within 60 days if more than 500 individuals affected, otherwise annually.
74
Q

what law creates national limits on the use of genetic information in health insurance and employment?

A

GINA

75
Q

Under GINA, can insurance providers implement higher premiums based on genetic tests?

A

No

76
Q

Under GINA employers can discriminate based on genetic information

A

No

77
Q

what type of entity does HITECH extend liability to?

A

to business associates for compliance.

CIPP Exam (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions