Part 716-Privacy of Consumer Financial Information Flashcards
The NCUA’s privacy regs define a member as an individual with a continuing relationship at the credit union
True
If a credit union does not anticipate disclosing information to affiliates, or non-affiliated, third parties for marketing purposes, the credit union is completely exempt from the NCUA privacy regulations
False
Verbal privacy notices are OK if the member signs a statement acknowledging the receipt of the verbal notice
False
If your credit Union provides nonpublic personal information with a nonaffiliated, third-party vendor or marketing purposes, your credit Union must provide your members with the opportunity to opt out of that information sharing
True
If a credit union does not anticipate closing information to affiliates or nonaffiliated third parties for marketing purposes, the credit union can provide a shortened simplified notice
True
A member must write and send the credit union and extensive letter, requesting to opt out of information sharing
False
How a service provider ( a vendor) safeguards members information is not a concern for your credit Union
False
If your credit Union wants to provide members information to a vendor to sell products, it must disclose this to members, provide them with an opt out notice, and make it easy for members to opt out from the vendors disclosure
True
There are significant penalties in civil liability for your credit Union, for violating the NCUA privacy regulations
False
Under the NCUA’s requirement for a credit union member information security program. Staff training on the security program is not a requirement, but is a good practice.
False
The NCUA requires a credit unions Board of Directors to not only assist in writing the policy for the credit union member information security program, but also to conduct an annual audit of the program as well
False
A credit Union is required to include the electronic protection of member information, and its members information, security program which includes
- developing the monitoring policies and procedures, and
- identifying and reasonably foreseeable internal and external threats based on the IT environment, and the products and services it provides
True
NCUA guidance provided to credit unions concerning electronic authentication programs includes
- Developing a process that is consistent and supports the credit unions, overall security and risk assessment program
- That is periodically reviewed and
- That includes auditing and monitoring features.
True
To avoid problems with pre-text calling and identity theft. The NCUA recommends that the credit union only give account information to the primary member on the account.
False
The NCUA regulations require an insured credit union to have a data security response program to address when there is unauthorized access to (a breach of)
member information. Such a program includes
1. accessing the nature and scope of the breach. (What information systems and member information was accessed)
2. notifying the NCUA regional Director, or state agency of the breach,
3. if warranted filing a SAR and
4. providing notice to members of the breach.
True
While the required notice to members as part of the data security, response program must include a description of the type of member information that was accessed and a phone number for members to call for further information and assistance. It does not need to include the name of the person who or group that
(the crooks) accessed that information
True
Under its data security response program a credit union may contract with its service provider (such as the data processing vendor) to notify all of its members and regulators that it’s information system has been breached
True
The children’s online protection program at (COPPA) is a federal law enacted to prohibit, unfair or deceptive Internet acts or practices in connection with the collection, use, and or disclosure of personal information from and about children under the age of 13, who can access the websites via the Internet?
True
The COPPA applies to a credit union whose website can be merely accessed by children under age 13
False
The COPPA does not require a parental consent if a credit union collects an email address from a child to respond to a request for information that it receives from that child
True
If your credit Union plans to collect use and disclose personal information from children under the age of 13, the COPPA, requires your credit union to have a website notice a parental notice and obtain parental consent
True
