Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP Certification > Module #5: Enforcement of US Privacy and Security Laws > Flashcards

Module #5: Enforcement of US Privacy and Security Laws Flashcards

1
Q

Types of Legal Action

A

1) Civil Litigation
2) Criminal Litigation
3) Administrative enforcement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Civil Litigation definition

A

Civil litigation is an action that occurs in the courts and involves a plaintiff suing a defendant
to redress a wrong

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Who initiates civil litigation

A

-Initiated by private party or government

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the burden of proof for civil litigation

A

a preponderance of evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the punishment for civil litigation?

A

either monetary or compensation

Or a court-ordered injunction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Definition of Civil Litigation

A

court proceedings for criminal prosecution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Who initiates civil litigation?

A

Criminal litigation is brought forth by the government for violations of criminal laws

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the burden of proof for Civil Litigation

A

Beyond a reasonable doubt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the punishment for civil litigation

A

fines
restitution
incarceration
death

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Administrative Enforcement definition

A

adjunction by an agency such FTC (federal trade commission) or FCC (federal communications commission)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Who initiates administrative enforcement?

A

Government agency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the burden of proof for administrative enforcement

A

burden of persuasion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the punishment for administrative enforcement

A

actions

fines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the basis of legal liability for:

  • Civil litigation
  • Criminal litigation
  • Administrative enforcement
A
  • civil litigation: tort, contract, and common law
  • criminal litigation: constitutions, laws, and regulations
  • Administrative enforcement: statutes that create agency governance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the 6 legal liability categories

A

1) negligence
2) breach of warranty
3) Misrepresentation
4) defamation
5) strict tort liability
6) statutory actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

negligence definition

A

Absence of, or failure to, exercise proper or ordinary care

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

defamation definition

A

untruth about another that will harm the reputation of the person or organization defamed in the form of libel (written defamation) or slander (oral defamation)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Strict tort liability definition

A

Extension of the responsibility of the vendor or manufacturer to
all individuals who might be injured by a product or service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

statutory actions

A

Action required, permitted or enacted by statute

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

misrepresentation definition

A

False security about the safety of a particular product or service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

breach of warranty definition

A

Failure of a seller to fulfill the terms of a promise, claim or
representation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

FTC Definition

A

The Federal Trade Commission (or FTC) is an independent federal agency that operates outside the direct control of the president.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

FTC Privacy enforcement

A

1914 FTC established to enforce antitrust laws

1938 - general consumer protection mission established

1970 - fair credit reporting act of 1970

1990 - congress added privacy-related responsibilities to FTC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the 4 Powers enforced by FTC

A
  • Preventing:
    - unfair methods of competition
    - Deceptive acts or practice
  • Seeking monetary redress
  • Prescribing trade regulation rules
  • Establishing requirements
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

3 Regulatory responsibilities of FTC are?

A
  • COPPA: The Childrens Online Privacy Protection Act of 1998
  • CAN-SPAM: The Controlling Assault of Non-Solicited Pornography and Marketing Act of 2003
  • HITECT: Health Information Technology for Economic and Clinical Health Act of 2009
26
Q

FTC: Deceptive Practices

A
  • False promises
  • Misrepresentations
  • Failures to comply with representations made to consumers
27
Q

FTC: Unfair Practices

A
  • Failure to implement adequate protection measures

- Providing inadequate disclosures to consumers

28
Q

What happens to noncompliant companies?

A

you need to cease and desist and resolve the issues. if so, there’s an agreement. or the consent degrees issue a consent order. it can recommend penalties up to 16k per infraction. it can recommend the fines.

investigations happen in two methods:

  • read the press
  • somebody complains to the FTC that you’re engaging in unfair or deceptive practices.

so they conduct an investigation and try to come to some type of agreement without going to court.

29
Q

suspected deceptive practices

Geocities, Inc. (1999)

A

GeoCities sold user information to third parties, which
violated the privacy notice on its website.

GeoCities settled the action, and the FTC issued a consent order, which required GeoCities to post and adhere to a conspicuous online privacy notice that disclosed to users how it would
collect and use personal information.

30
Q

suspected deceptive practices

Snapchat (2014)

A

Snapchat promised its customers a private, short-lived messaging service that messages disappear “forever” after a brief time.

“Find Friends” feature provided information to the company and individual users they snapchats with. Snapchat was aware there were ways to save messages and company was collecting names and phone #s of all users contacts. Find friends was inadequately secure and resulted in hackers compiling a database of million of users names and passwords.

Snapchat entered a consent order that it would not engage in these practices for the next 20 years

31
Q

suspected unfair practices

LifeLock, Inc. (2010)

A

Lifelock failed to encrypt its customers data putting it at risk. In the consent decree, paid significant fines and to protect its customers’ sensitive personal data to be assessed every 2 years for compliance. In 2016 lifelock failed to comply with the consent which required lifelock to pay millions of dollars as repayments to customers’ monthly premiums and a fine to the state attoe

32
Q

suspected unfair practices

Wyndham Worldwide Corporation (2012)

A

3 hacks to Wynham’s systems FTC alleged that they did not adequately protect its customers sensitive data. the company chose initially to not settle the case. court decisions and appeals findings in favor of the FTC and Wyndham agreeing to enter a consent order with the FTC.

33
Q

Department of Commerce

A

-leading role in federal privacy development
-EU-US Privacy Shield administration
-

34
Q

Department of Homeland Security

A
  • E-Verify program; rules for air traveler records (TSA)

- Immigration; other border issues (Immigration and Customs enforcement)

35
Q

State Department

A

-negotiates internationally with other countries on privacy issues and in multinational groups

36
Q

Office of Civil Rights (HHS)

A

Role in enforcing HIPPA rules

37
Q

Department of Transporation

A
  • transportation companies
  • Drones (FAA)
  • Internet-connected cars (national highway traffic safety administration)
38
Q

Internal Revenue Service

A

Privacy rules concerning tax records

39
Q

Office of Management and Budget

A
  • Interpretation of Privacy Act of 1974

- Guidance to federal agencies and their contractors

40
Q

FTC Priority in late 1990s

A
  • notice and choice approach

- deception and failure to comply

41
Q

FTC Priorities in 2001-2009

A
  • Harm-based model
  • Harm from identity theft
  • privacy-program requirements
  • impacts beyond tangible financial harm
42
Q

FTC Priority in 2012

A 
Whitehouse report: "consumer data privacy in a networked world: a framework for protecting privacy and promoting innovation in the global digital economy"
 including:
      -individual control
      -transparency
      -respect for context
      -respect for content
      -security
      -access and accuracy
      -focused collection and accountability
43
Q

FTC Priority in 2015

A
    • data security investigations
    • FTC entered in consent orders with ASUS and TRENDnet
    • FTC enforcement actions for unfair practices when unreasonably and unnecessarily exposed consumers’ personal data
44
Q

FTC Priority in 2016

A

Cases:

  - InMobi and Turn: tracked user location and browsing history without permission
  - Vulcan: installed apps onto smart phones without permission

letter of warning to 12 app developers:
-cautioned app developers related to claimed or implied data was not being collected or transmitted when it is.

FTC 3-part to examine consumer protection issues:

  - smart tv's
  - drones
  - ransomware
45
Q

FTC Priority in in 2017

A

recent cases:
-Lenova: did not disclose to consumers preinstalled software program, VisualDiscovert, which acted as a man-in-the-middle between consumers and websites with which they communicated

  - Vizio: smart Tv's installed software to collect viewing data on 11 million consumer TVs without consumers knowledge or consent
  - Tru Communication, Decusoft, and Md7 charges settled for misleading consumers about their certification to participate in the EU-US Privacy Shield
46
Q

FTC Priority in 2018

A

recent cases:

  - Venmo: misrepresented steps for keeping financial transactions private which failed Gramm-Leach-Bliley Privacy Rule and Safegaurds rule requirements  - Facebook privacy practices and fine reported $5 billion
47
Q

FTC Priority in 2019

A
  • FTC and US Dept of Justice announced a settlement with Facebook for $5 billion penalty as well as modifications to their overall approach to privacy
    - Cambridge Analytica complaint that users were unaware their personal data was being harvested for illegal voter profiling and targeting
48
Q

FTC Report principals in 2012

A

“protecting consumer privacy in an era of rapid change: recommendations for business and policymakers”

  - privacy by design
  - simplified consumer choice and transparency
49
Q

FTC 5 Principles in 2015

A

“Privacy and Data Security Updates”

  - Know what data you have and rights / need to access
  - limit data retained based on legitimate need
  - implement safeguards to protect data
  - dispose of data when no longer needed
  - plans for security incidents
50
Q

Workshops hosted by FTC in 2017

A

FTC hosted workshops on privacy issues:

  - connected cars
  - education technology
  - identity theft
51
Q

Workshops hosted by FTC in 2018

A

FTC hosted workshops on privacy issues:

  - fraudulent practices around cryptocurrency
  - data breaches
52
Q

State Regulation

A
  • Inadequate data protection
  • AGs (attorney generals)
  • laws and statutes to protect privacy
53
Q

Cross-border Regulation

A

-cooperation:

OECD recommendation: Organization for Economic Cooperation and Development
-Recommendation on Cross-Border Co-operation in the Enforcement of Laws Protecting Privacy, which promotes addressing common privacy issues on a global scale

GPEN: Global Privacy Enforcement Network
-motivated the FTC and other enforcement agencies around the
world to form

APEC CPEA: AsiaPacific Economic Cooperation & Cross-border Privacy Enforcement Arrangement
-establishes a framework for members to share information and evidence in crossborder investigations and enforcement actions in the Asia-Pacific region, as well as facilitating communication between APEC and non-APEC members.

54
Q

Self-Regulatory Regulation

A

-internal frameworks, policies and procedures

approaches to privacy protection have been created by some organizations, through which they monitor their own privacy guidelines and practices.

Organizations may also adopt the guidelines of a third party that monitors and enforces compliance

55
Q

federal vs state authority

A

law-making power is shared between federal and state governments

US constitution says its “the supreme law of the land”

10th amendment states powers not delegated to the US by the Constitution nor prohibited by the states are reserved to the states, or to the people

some federal laws preempt even stricter state laws. conversly some federal laws may be superseded by state laws

56
Q

What theory of legal liability is described as the absence of or failure to exercise proper or ordinary care?

A) Defamation
B) Negligence
C) Breach of warranty
D) Strict tort liability

A

B) Negligence

57
Q

Which of the following are powers of the FTC? Select all that apply.

A) Penalizing and halting unfair or deceptive trade practices

B) Seeking monetary redress for conduct injurious to consumers

C) Prescribing trade regulation rules

D) Administering self-certification programs for honest trade practices

E) Establishing requirements to prevent unfair or deceptive trade practices

A

A, B, C, and E

all but Administering self-certification programs for honest trade practices

58
Q

Which federal agency is the most visible proponent of privacy concerns in the U.S.?

A) Department of Commerce (DOC)

B) Department of Homeland Security (DHS)

C) Office for Civil Rights (HHS)

D) Federal Trade Commission (FTC)

A

D) Federal Trade Commission (FTC)

59
Q

During which decade did the FTC’s perspective evolve into a harm-based model?

A) 1980s
B) 1990s
C) 2000s
D) 2010s

A

C) 2000s

60
Q

What does GPEN stand for?

A) Good principles for encrypting numerals
B) Grades of privacy employment negligence
C) Guild of Privacy Economic Nations
D) Global Privacy Enforcement Network

A

D) Global Privacy Enforcement Network

CISSP Certification (14 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions