Privacy Flashcards
The CCPA is most similar to what set of laws?
Europe’s General Data Protection Regulation (GDPR).
The CCPA applies to what?
Any statutorily defined business that processes consumers’ personal information, provided that the entity does business in California, and either has annual gross revenues exceeding $25 million, buys, receives, sells, or shares the personal information of 50,000 or more consumers, households, or devices or receives 50 percent or more of annual revenue results from sales of consumers’ personal information.
Who does the CCPA protect?
Any “natural person who is a California resident.”
What kind of information does the CCPA protect?
Personal information, which includes any “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”
What is de-identified information?
Information that can be used by a business without restriction, but it cannot “reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer.”
Under the CCPA, what are a business’ notice obligations?
A business must provide 2 types of Notice: Initial (Notice “at or before the point of collection,” about the nature and purpose of the collection) and Website (Notice that provides a full description of the rights that a consumer may exercise).
What are a consumer’s rights under the CCPA?
A consumer has a 1) right to request certain disclosures of information and the right to opt out of data sales via a “clear and conspicuous” link.
Under what circumstances is a private individual permitted to bring an action under the CCPA?
Data breach incidents.
Who enforces the CCPA?
California attorney general except where a data breach has occured.
What are the four steps of dealing with a data breach?
The steps are 1) determining whether a breach has happened, 2) containing the breach, 3) notifying impacted parties, and 4) post-incident evaluations and training.
State data breach laws have what basic elements in common?
The elements are 1) The definition of personal information, 2) The definition of a “security breach,” 3) The level of harm requiring notification, 4) Whom to notify, 5) When to notify affected parties, 6) What to include in the notification letter, 7) How to notify affected parties, 8) Notice requirements to state attorney general or state agency, 9) When notice is required to credit reporting agencies, 10) Exceptions, and 11) Penalties and rights of action.
Under data breach statutes, what is personal information?
First and Last Name with any one of 1) SS#, 2) Drivers License or ID Card #, or 3) financial account information.
Who is subject to state data breach notification laws?
Any person/business who conducts business in this state, and who, in the ordinary course of such person’s business, owns, licenses, or maintains computerized data that includes personal information.
What is a data breach?
Unauthorized access to or acquisition of unprotected/unsecured electronic files, media, databases, or computerized data containing personal information.
Under HIPAA, what is Protected health information (PHI)?
Any individually identifiable health information, held by a covered entity or its business associate, that identifies the individual or offers a reasonable basis for identification and relates to a past, present or future physical or mental condition, provision of health care, or payment for healthcare to that individual.
What are covered entities under HIPAA?
Healthcare providers that conduct certain transactions in electronic form, Health plans, or Healthcare clearinghouses.
What is a business associate under HIPAA?
Any person or organization that performs services and activities for, or on behalf of, a covered entity, if such services or activities involve the use or disclosure of PHI.
What is the Security Rule under HIPAA and how was it modified under HITECH?
Security Rule required covered entities to ensure the confidentiality of PHI against reasonably anticipated threats, have agreements with business associates to protect the information, identify a person designated to oversee compliance, and conduct ongoing evaluations of protection measures and training. HITECH imposed the same restrictions against business associates.
The Privacy Rule under HIPAA requires what?
A covered entity must provide a detailed notice of privacy rights at the date of first service, including the right to obtain a copy of the information. Entities must also require authorization for use of info outside of HIPAA guidelines and implement appropriate safeguards to protect the information.
What entities are regulated by the FCRA?
Any “consumer reporting agency” (CRA) that furnishes a “consumer report.”
What is a CRA under FCRA?
Any person or entity that compiles or evaluates personal information for the purpose of furnishing consumer reports to third parties for a fee.
What is a consumer report under the FCRA?
A consumer report is any communication by a CRA related to an individual that pertains to the person’s: Creditworthiness, Credit standing, Credit capacity, Character, General reputation, Personal characteristics, or Mode of living.
How does the FCRA regulate users of consumer reports?
Consumer reports must be appropriately accurate, current, and complete. Consumers must receive notice when a consumer report is used to make adverse decisions about them. Consumer reports may be used only for permissible purposes. Consumers must have access to their consumer reports and an opportunity to dispute them or correct any errors.
Under the FCRA, what must a CRA do?
Provide consumers with access to the information contained in their consumer reports as well as the opportunity to dispute any inaccurate information. Take reasonable steps to ensure the maximum possible accuracy of the information in the consumer report. Not report negative information that is outdated. Provide consumer reports only to entities that have a permissible purpose under the FCRA. Maintain records regarding entities that received consumer reports. Provide consumer assistance as required by FTC rules.
Where is enforcement of the FCRA available?
FCRA is available through dispute resolution, private litigation, and government actions.
What is FACTA?
Fair and Accurate Credit Transactions Act. FACTA required truncation of card numbers, gave consumers the right to request a free credit report, and imposed the Disposal Rule and the Red Flags Rule.
Does FACTA preempt state laws?
Yes.
What is the Disposal Rule under FACTA?
The Disposal Rule requires any individual or entity that uses a consumer report, or information derived from a consumer report, for a business purpose to dispose of that consumer information in a way that prevents unauthorized access and misuse of the data.
