Introduction to Privacy Flashcards
In 1890, the American, Louis Brandeis and Samuel Warren published which publication?
The Right to Privacy
The “Right to Privacy” publication defined privacy as _____________________?
The right to be left alone
_______________ is defined as the desire of people to freely choose the circumstances and the degree to which individuals will expose their attitudes and behavior to others.
Privacy
What are the four classes of privacy?
Information Privacy
Bodily Privacy
Territorial Privacy
Communications Privacy
_______________ Privacy are rules that govern the collection and handling of personal information.
Information Privacy
Personal information, financial information, medical information, government records and records of a person’s activities on the internet are examples of _________________ Privacy.
Information Privacy
_______________ Privacy is focused on a person’s physical being and invasion thereof.
Bodily Privacy
Drug Testing, genetic testing, body cavity searches, abortion and adoption are examples of _____________ Privacy.
Bodily Privacy
________________ Privacy refers to limitations on intruding into another individual’s environment.
Territorial Privacy
Invasion into ______________ Privacy typically takes the form of monitoring, such as video surveillance, ID checks, and use of similar technology.
Territorial Privacy
True or False?
In Territorial Privacy, another individual’s “environment” is limited to the home.
False
Environment is not limited to the home but may include the workplace or public space.
_______________ Privacy protects the means of correspondence.
Communication Privacy
Phone conversations, postal mail, email and other forms of communication are examples of ___________________ Privacy.
Communication Privacy
The industry standard in assessing risk is:
Risk = ________ X ________ X _________
Risk = Threat x Vulnerability x Expected Loss
The ________ associated with a company’s information technology is directly related to threats, vulnerabilities and expected loss.
Risk
_____________ are any circumstances that may cause an undesirable event.
Threats
Data breach is an example of a ___________.
Threat
____________ are weaknesses in an organization’s information systems policies or procedures.
Vulnerabilities
When a threat exploits a vulnerability, a __________ causes risk to occur.
Security Event
________ = Probability of an event occuring
X
Expected Loss associated with event
Risk for a particular security event
_________ Act lays out the basic rules for agency enforcement actions.
Administrative Procedure Act
Fair Information Practices (FIPs) are also known as ________________________.
Fair Information Practice Principles (FIPPs)
___________ have been used since the 1970’s as a means for organizing individual’s privacy rights and organizing personal information (PI) responsibilities.
Fair Information Practices (FIPs)
also known as
Fair Information Practice Principles (FIPPs)
___________ dates back to a 1973 report by the US Department of Health, Education and Welfare Advisory Committee on Automated Systems.
Fair Information Practices (FIPs)
also known as
Fair Information Practice Principles (FIPPs)
Fair Information Practices (FIPs) have ______ categories.
Four
What are the Fair Information Practices (FIPs) categories?
Rights of Individuals
Controls on Information
Information Life Cycle
Management
Notice, choice/consent and data subject access refer to which FIPs category?
Rights of Individuals
True or False
Organizations should provide notice about their privacy policies and procedures.
True
___________ identifies the purpose personal information (PI) is collected, used, retained and disclosed.
Notice
___________ can be implicit or explicit with respect to the collection, use, retention and disclosure of personal information (PI).
Consent
In reference to the “Rights of Individuals” FIPs category, ___________ is important when disclosing personal information (PI) to other data controllers.
Consent
In reference to the “Rights of Individuals” FIPs category, ___________ occurs when organizations provide access to an individual’s personal information (PI) for review and update.
Data Subject Access
Information Security and Information Quality refer to which FIPs category?
Controls on the Information
___________ refers to using reasonable administrative, technical and physical safeguards to protect personal information (PI) against unauthorized use, disclosure, modification and destruction.
Information Security
__________ refers to maintaining accurate, complete and relevant personal information (PI) for the purposes identified in the notice.
Information Quality
Collection, Use and Retention and Disclosure refer to which FIPs category?
Information Lifecycle
In reference to the “Information Lifecycle” FIPs category, ___________ refers to gathering personal information only for the purposes identified in the notice.
Collection
True or False
Organizations should limit the use of personal information (PI) to the purposes identified in the notice only.
False
Organizations should limit the use of personal information (PI) to the purposes identified in the notice and where the individual has provided implicit or explicit consent.
True or False
Organizations should retain personal information (PI) for at least two (2) years.
False
Organizations should retain personal information (PI) for only as long as necessary to fulfill the stated purpose.
True or False
Organizations should disclose personal information (PI) to third parties for the purposes identified in the notice only.
False
Organizations should disclose personal information (PI) to third parties for the purposes identified in the notice and where the individual has provided implicit or explicit consent.
Management, administration, monitoring and enforcement refer to which FIPs category?
Management
In reference to the “Management” FIPs category, ___________ and ___________ refers to when organizations define, document, communicate, and assign accountability for their privacy policies and procedures.
Management and Administration
In reference to the “Management” FIPs category, ___________ and ___________ occurs when organizations monitor compliance with their privacy policies and procedures and have procedures to address privacy-related complaints and disputes.
Monitoring and Enforcement
