PrivacyReffFlashCards
1
Q
Accountability
A
The use of organizational and technical measures which demonstrate that personal data is handled in compliance with relevant law.
2
Q
Adequate Level of Protection
A
Confirmation that a data transfer accounts for the rule of law and legislation, respect for human rights, data protection rules, professional rules and security measures, data subject rights, independent supervisory authorities, and any international commitments.
3
Q
Adverse Action
A
Any business, credit, or employment action that affects consumers negatively, such as denying or canceling credit, insurance, employment, or promotion. A credit transaction where the consumer accepts a counteroffer would not count.
4
Q
American Institute of Certified Public Accountants
A
The U.S. professional organization of certified public accountants that co-created the WebTrust seal program.
5
Q
Americans with Disabilities Act
A
A U.S. law that prohibits discrimination against certain individuals with disabilities
6
Q
Anti-discrimination Laws
A
Indications of special classes of personal data. If these exist based on a class or status, it is likely that the personal information is subject to more prescriptive data protection regulation.
7
Q
APEC Privacy Principles
A
A set of non-binding principles adopted by the Asia-Pacific Economic Cooperative (APEC) that mirror the OECD Fair Information Privacy Practices. These promote electronic business in the Asia-Pacific region with a balance of information privacy and business need.
8
Q
Background Screening/Checks
A
Verifying an applicant’s ability to function in the working environment in a way that ensures the safety and security of existing workers. These could involve checking a person’s educational background or past criminal activity. Employee consent requirements may be negotiated with work councils and varied by member state.
9
Q
The Bank Secrecy Act
A
A U.S. federal law requiring U.S. financial institutions, money services businesses, or entities that sell money orders or provide cash transfer services, to report, retain, and record qualified financial transactions to the federal government. This is meant to help the government investigate instances of money laundering, tax evasion, terrorist financing and other criminal activities.
10
Q
Behavioral Advertising
A
Advertising targeted at individuals based on the observations about their activity over time, most often done via automated processing of personal data, or profiling.
11
Q
Binding Corporate Rules
A
An appropriate GDPR safeguard for cross-border transfers of personal data between two or more entities of a corporate group. These ensure that the same high level of personal data protection is followed by all members of the group through a set of enforceable rules.
12
Q
Binding Safe Processor Rules
A
Binding Corporate Rules that may now be used for both controllers and processors under the GDPR.
13
Q
Breach Disclosure
A
An organization must notify regulators and/or victims of incidents that have impacted the confidentiality and security of personal data. This transparency mechanism brings light to operational failures, helps mitigate harm, and assists in the identification of causes of failure.
14
Q
Bring your own device(BYOD)
A
Allowing employees to use their own personal computing device for work.
15
Q
California Consumer Privacy Act
A
The first state-level comprehensive privacy law in the U.S. which applies to businesses that collect personal information from California consumers. This law created consumers’ rights to access, deletion, opt-out of sale, and nondiscrimination while also imposing specific transparency and disclosure obligations. The precursor to the California Privacy Rights Act, which will enter into force Jan 1, 2023
16
Q
California Investigative Consumer Reporting Agencies Act
A
The California state law establishing that employers must notify applicants and employees of any intention to obtain and use their consumer report
17
Q
California Online Privacy Protection Act
A
This act requires that all websites targeted to California citizens must provide a privacy statement to visitors with an easy-to-find link. Websites that collect personal data from individuals under 18 years of age must permit those children to delete their data. Websites are required to inform visitors of which Do Not Track mechanisms they support, if any.
18
Q
California Privacy Rights Act
A
This act amended the California Consumer Privacy Act with more consumer privacy protections and an enforcement agency, the California Privacy Protection Agency. The provisions entering into force January2023 will apply in retrospect up to January 2022
19
Q
Case Law
A
Law principles established by judges in previous decisions. When similar issues come back up, judges use the prior decisions as precedents and keep new case decisions consistent.
20
Q
CCTV
A
An acronym for “closed circuit television” which has become shorthand for any video surveillance system. These can be hosted via TCP/IP networks and accessed remotely, and the footage very easily shared
21
Q
Children’s Online Privacy Protection Act(COPPA) of 1998
A
A U.S. federal law applying to operators of commercial websites and online services either directed to children under the age of 13 or known to collect personal information from children under the age of 13. Operators are required under this law to post a privacy notice on the website, provide notice about collection practices to parents, obtain verifiable parental consent before collecting personal information of children, give parents the choice about whether their child’s personal information will be shared with third parties, provide parents with rights to access, delete, and opt out of future collection or use of the information, and maintain the confidentiality, security and integrity of children’s personal information.
22
Q
Choice
A
The concept that consent must be freely provided and data subjects have a true choice whether to provide personal data or not, without which it is unlikely the consent would be considered valid under GDPR.
23
Q
Cloud Computing
A
Information technology services provided over the Internet by organizations for internal users or third-party suppliers. The service options may be software, infrastructure, hosting, or platforms for applications ranging from personal e-mail to corporate data storage.
24
Q
Collection
Limitation
A
The fair information practices principle
which says that there should be limits in the
collection of personal data, where data
should be gathered y fair and lawful means
with the knowledge or consent of the data
subject.
25
Commercial
| Activity
This refers to any transaction, act or conduct,
or any regular course of conduct that is
commercial as defined by PIPEDA, which may
include selling, bartering or leasing of donor,
membership, or other fundraising lists.
Non-profit associations, unions, and private
schools may exist outside of this definition.
26
Commercial
Electronic
Message
```
Electronic messaging in any form,
including e-mail, SMS text messages, and
messages sent via social media where the
purpose could be deemed asencouraging
participation in a commercial activity.
These may be electronic messages that offer to
promote, purchase, sell, or lease products,
goods, or services.
```
27
Common
| Law
Undocumented legal principles developed
over time according to on societal
expectations and customs.
28
Communications
| Privacy
The class of privacy that encompasses
protection of the means of correspondence,
including mail, phone conversations,
and e-mail
29
Comprehensive
| Laws
Laws governing the collection, use, and
disclosing of personal information in both
public and private sectors.
30
Computer
| Forensics
Assessing and inspecting an information
system for clues after being compromised
or exploited.
31
Confidentiality
The principle that data should be protected
| against unauthorized or unlawful processing.
32
Confirmed
| Opt-In
An email consent for direct marketing
where marketers send a confirmation email
eliciting a response ahead of the actual
marketing e-mail.
33
Consent
The confirmation of an individual’s agreement
to the collection, use, and disclosure of
their personal data.
There are two thoughts on this:
opt-in (making an affirmative action) and
opt-out (implied by lack of action).
34
Affirmative /
Explicit
Consent
The type of consent requiring that an
individual indicate agreement with a data
controller through active communication.
35
Implicit
| Consent
The type of consent that is inferred from
| the action or inaction of the individual.
36
Consent
| Decree
A judgment into which the parties enter
by consent. The defendant usually agrees to
stop alleged illegal activity and pay a fine,
without any admission. A judge needs to
approve and formalize the agreement
reached between a U.S. federal or state
agency and an adverse party.
37
Consumer
Financial
Protection
Bureau
The independent bureau within the Federal
Reserve created by the Dodd-Frank Act
with enforcement power to take action
against abusive acts and practices as included
in the law.
38
Consumer
Reporting
Agency
Any person or entity that assembles or
evaluates personal information in order to
provide consumer reports to third parties
39
Cookie
A small text file stored on a client machine
to be retrieved by a web server. These keep
track of the end user’s browsing activities
and pool individual requests into sessions.
They also allow users to stay signed in.
Types include first party, third party, session,
and persistent.
40
Credit
| Freeze
A security measure initiated by a consumer
to locks their data with consumer reporting
agencies to prevent identity thef.
41
Credit
Reporting
Agency
Any organization that regularly engages in
compiling or evaluating personal information
in order to provide consumer reports to third
parties under the Fair Credit Reporting Act.
42
Customer
| Access
The customer’s ability to view, correct, or
delete the personal information collected
from or about them.
43
Customer
| Information
Data relating to private-sector clients, healthcare
patients, and the public for public-sector
agencies that provide services
44
Data
| Breach
```
The unauthorized collection of
computerized data that interrupts the
security, confidentiality, or integrity of
personal information maintained by a
data collector.
```
45
Data
| Classification
A scheme organizing different categories of
| data with appropriate handling and access.
46
Data
| Controller
The natural or legal person, public authority,
agency or any other body who alone or
jointly decides the intentions and means
of personal data processing.
47
Data
| Elements
A piece of data with a distinct definition
which can’t be whittled down further.
Examples include date of birth, numerical
identifier, or location coordinates.
In isolation these may not be considered
personal data but they would be
when combined.
48
Data
| Matching
```
Comparing personal data compiled from
a number of sources, including personal
information banks, in order to make
decisions about the individuals to whom
the data relate.
```
49
Data
| Processing
Any operation or set of operations
performed on personal data including
alteration, collection, recording, restriction,
storage, use, retrieval, disclosure,
dissemination, combination, organization,
erasure, or destruction, whether
by automated means.
50
Data
| Processor
The natural or legal person public authority,
agency or other body not employed by the
controller who processes personal data as
instructed by the controller.
51
Data
| Quality
```
The fair information practices principle
that says personal data should be relevant,
accurate, up-to-date, and complete.
Four questions to consider: does it meet
the business needs; is it accurate;
is it complete, and is it recent?
```
52
Data
| Recipient
The natural or legal person, public authority,
agency, third party, or another body
getting personal data by disclosure.
This would not apply to public authorities
getting personal data in the context of an
EU or member state law inquiry.
53
Data
| Subject
An identified or identifiable natural person
about whom the organization has personal
information.
54
Deceptive
Trade
Practices
```
The actions of corporate entities who mislead
or misrepresent products or services to
consumers and customers in the context
of US federal law. The FTC and attorney
general or office of consumer protection
would respond to these issues.
Law typically allows enforcement by the
government and actions for damages
brought by harmed consumers.
```
55
Defamation
Common law tort focuses on this concept,
which is defined as a communication intending
to harm another’s reputation
56
Digital
| Finger printing
Using log files to identify a website visitor for
security and system maintenance purposes.
Log files typically include URLs, web browsers,
font preferences, operating systems,
IP addresses, and time stamps.
57
Digital
| Signature
A protective measure for the authenticity of
an electronic document, such as an e-mail,
text file, spreadsheet or image file. It would
be rendered invalid if anything is changed
in the electronic document post attachment
58
Direct
| Marketing
Direct contact made to an individual by the
seller, in contrast to mass media marketing
through radio or TV.
59
Do Not
| Track
A potential policy allowing consumers the
right to opt out of web tracking, in the same
vein as the existing US Do-Not-Call Registry.
60
Do-Not-Call
Implementation
Act of 2003
This act granted the FTC authority to create
the National Do-Not-Call Registry.
The registry is open to all consumers who
wish to place their phone number on the
national list to stop telemarketers (except
political activities and non-profits)
from calling unsolicited.
61
Do-Not-Call
Improvement
Act of 2007
This act amended the US
Do-Not-Call Implementation Act to make
registration permanent in place of the
requirement for re-registration
62
Dodd-Frank Wall
Street Reform
and Consumer
Protection Act
US Congress passed this act in 2010 to
restructure and enhance financial regulation.
This created the Consumer Financial
Protection Bureau with rule-making
authority over FCRA, GLBA, and other laws.
63
Electronic
Communications
Privacy Act of
1986
The Electronic Communications Privacy
and Stored Wire Electronic Communications
Acts combined, which reformed the
Federal Wiretap Act of 1968. This law
protects e-mail and phone calls while being
made, stored on computers, and in transit.
64
Electronic
| Discovery
Information exchanged between parties
| and their attorneys in preparation for trial.
65
Electronic
Health
Record
An individual’s medical file that may be
shared across multiple healthcare settings
via computer. Examples include radiology
images, medical history, medication and
allergies, personal stats, immunization
status, laboratory test results, vital signs,
demographics, and billing information.
66
Electronic
| Surveillance
Monitoring that is done through electronic
means, using things like video surveillance,
communications, and location.
67
Employee
| Information
Personal information reasonably necessary
for an organization to collect, use, or disclose
in order to establish, maintain, or terminate
employment or volunteer work.
68
Employment
| at Will
The understanding that the employment
contract can be ended by the employee or the
employer at any moment for any reason.
69
The Equal
Employment
Opportunity
Commission
The independent US federal agency enforcing
laws against discrimination in the workplace.
Discrimination complaints based on an
individual’s race, color, origin, religion, age,
intelligence, disability, and retaliation would be
investigated. Discrimination suits may be filed
against employers on behalf of alleged victims.
70
Established
Business
Relationship
A prior or existing connection between the
individual and a marketer that allows them to
call the individual even if they are on the DNC
registry. It would be formed by a voluntary two way
communication between the marketer and a
residential subscriber for the purpose of an inquiry,
application, purchase, or transaction
by the residential subscriber regarding
products or services offered.
71
EU Data
Protection
Directive
The first EU-wide legislation protecting
personal data use and privacy which was
adopted in 1995 and replaced by
GDPR in 2018.
72
EU-US Safe
Harbor
Agreement
```
A agreement between the EU and
United States invalidated by the Court
of Justice of the European Union in 2015
which allowed legal transfer of personal
data between the US and the EU without
an adequacy decision. The EU-US Privacy
Shield replaced this agreement in 2016.
```
73
EU-US
Privacy
Shield
```
The data transfer mechanism created in
2016 to replace the invalidated US-EU
Safe Harbor agreement which allowed for
the transfer of personal data from the EU
to the United States for participating
companies before it was invalidated in
2020 by Max Schrems.
```
74
European
| Commission
```
The executive body of the European Union
created to implement the EU’s decisions
and policies.It proposes drafts of legislation
that are then handed over to Parliament
and the Council of the EU. It also makes
data transfer adequacy decisions.
```
75
Fair and
Accurate Credit
Transactions
Act of 2003
```
Anexpansion of the FCRA focusing on
identity theft prevention and customer
access. It requires credit reporting agencies
to allow consumers a free credit report
once in twelve months.
It also empowers consumers to request
alerts when there is suspicion of
identity theft.
```
76
The Fair
Credit
Reporting Act
A US federal privacy law enacted in 1970
to demand relevancy and accuracy in data
collection, the provision of the ability for
consumers to access and correct their
information, and limitations on the use of
consumer reports for appropriate purposes,
like the extension of insurance or credit and
employment.
77
The Federal
Communications
Commission
```
The United States agency regulating
interstate communications through satellite,
radio, cable, and telecommunications.
Its authority coincides with the FTC in
privacy law for the enforcement and
regulation provided by the Telephone
Consumer Protection Act.
```
78
Federal
Trade
Commission
The primary consumer protection agency in
the US which compiles complaints about
companies, business practices, and identity
theft under the FTC Act and other laws.
They bring enforcement action from the
FCRA and Section 5 of the FTC Act on
unfair and deceptive trade practices.
79
Financial
Industry
Regulatory
Authority
A corporation acting as a regulator for
exchange markets and brokerage firms
to ensure that security exchange markets
operate transparently and protect investors.
It is subject to the Securities and Exchange
Commission.
80
```
Financial
Institutions
Reform, Recovery,
and Enforcement
Act of 1989
```
This act was passed after the savings and
loans crisis of the 1980s to allow financial
regulators to impose penalties for failing
to comply up to $5,000,000 for failure t
o comply with regulations including
GLBA’s information privacy requirements.
81
The Freedom
of Information
Act
A US. federal law ensuring access to
federal executive branch documents by
citizens.
There limited exemptions
82
GET
| Method
```
Attributes from this method, as opposed
to the POST HTML method, prescribe
how form data is provided to a URL,
particularly in name/value pairs showing
passwords and other sensitive information
in the browser’s address bar.
```
83
Global Privacy
Enforcement
Network
The collection of data protection authorities
set by an OECD recommendation for
collaboration among member countries
on enforcing privacy laws, developing
common priorities, sharing best practices,
and supporting joint enforcement
and awareness activities.
84
Gramm-Leach-
Bliley
Act (GLBA)
```
The Financial Services Modernization Act
of 1999 reorganizing financial services
regulation for any US company “significantly
engaged” in financial activities. It pertains
to the handling of non-public personal
information, like a consumer’s name a
nd address and interactions with
financial institutions.
```
85
Health Breach
Notification
Rule
```
A US rule under HITECH requiring that
vendors of personal health records and
related entities inform consumers if the
security of their individually identifiable
health information is breached.
```
86
```
The Health
Information
Technology for
Economic and Clinical
Health Act (HITECH)
```
This act focuses on privacy and security issues
with PHI as defined by HIPAA.
Privacy provisions specified pertain to the
introduction of categories of violations
based on accountability corresponding to
penalty ranges.
87
```
The Health
Insurance
Portability and
Accountability Act
(HIPAA)
```
A US law passed to make national standards
for electronic healthcare transactions. It
requires that the U.S. Department of Health
and Human Services create regulations
securing the privacy and security of
personal health information.
Patients must opt in before their information
is shared with third parties
88
Information
| Life Cycle
This approach recognizes different values
of data and data handling through an
organization between collection and
deletion. The stages involved are: collection,
processing, use, disclosure, retention,
and destruction.
89
Information
| Privacy
```
The class of privacy which refers to the
right of individuals, groups, or institutions to
determine when, how, and to what
extent information about them is
disclosed to others.
```
90
Information
| Security
Protecting information in order to prevent
loss, unauthorized access, and misuse.
This includes measuring threats and risks
to information and the processes and
measures to be taken to preserve the
confidentiality, integrity and availability
of information.
91
Junk Fax
Prevention
Act of 2005
This act created the Existing Business
Relationship exception to the US Telephone
Consumer Protection Act’s ban of fax-based
marketing without consent. It required
that marketing faxes include how to opt out
of future unsolicited communications.
92
Jurisdiction
A court’s authority to hear a specified case.
Courts must have authority over both the
type of dispute (subject matter) and the
parties (personal). It also refers to the
geographical area or subject-matter
applicable to such authority.
93
Location-Based
| Service
Services that use location information to
provide applications and services, including
gaming, social networking, and
entertainment, usually needing geolocation
to identify the real-world geographic location
94
Medical
| Information
Records or information received from
licensed physicians, hospitals, clinics,
or other medical facilities with the consent
of the related individual.
95
Minimum
Necessary
Requirement
```
The establishment that the level of
information disclosed by healthcare
providers to third parties is the smallest
amount required to fulfill the desired
purpose as provided by HIPAA.
```
96
Multi-Factor
| Authentication
The authentication process using multiple
verification methods, like a password and
code sent to a phone number, or log-in
and biometric identifier.
97
National
Do-Not-Call
Registry
Consumers in the US put their phone
number on a list prohibiting unsolicited
calls from telemarketers. Registration is
permanent and enforced by FCC, FTC, and
state attorneys general for a fine of up to
$16,000 per violation.
98
The National
Labor Relations
Board
```
The US federal agency governing the
National Labor Relations Act by holding
elections to determine if employees want
to receive union representation and
investigating improper labor practices.
```
99
National
Security
Letter
A category of subpoena whose use was
expanded by The USA PATRIOT Act. Access
is administered by separate statutory provisions
without a court order to communication
providers, travel agencies, financial institutions,
and consumer credit agencies.
100
Negligence
An organization is liable for damages
related to any breach of legal duty to
protect personal information and if an
individual is harmed in the process.
101
Non-Public
Personal
Information
Personally identifiable financial information
resulting from a transaction or service made
for the consumer, shared by the consumer to a
financial institution, or otherwise collected by
the financial institution, as defined by GLBA.
102
OECD
| Guidelines
A universal set of internationally accepted
privacy principles and guidance for countries
developing regulations related to cross-border
data flows and law-enforcement access to
personal data. The principles are Collection
Limitation, Data Quality, Purpose Specification,
Use Limitation, Security Safeguards, Openness,
Individual Participation, and Accountability.
103
Omnibus
| Laws
Laws covering a wide range of organizations
or natural persons, not simply a specific
market sector or population
104
Online
Behavioral
Advertising
Websites or online advertising services that
track and analyze search terms, demographics,
online activity, offline activity, browser or
user profiles, location data, or preferences,
to offer advertising.
105
Opt-In
One of two approaches to choice, where
an individual makes an affirmative indication of
agreement, like checking a box to allow
the business to disclose the information to
third parties.
106
Opt-Out
One of two approaches to choice, where the
lack of action on the part of the individual is
taken as their implication of choice, so
for example, their information will be
shared with third parties if they don’t
uncheck a box.
107
Organization for
Economic
Cooperation and
Development
An international organization that supports
policies created to boost employment,
sustainable economic growth, and the
standard of living.
108
Outsourcing
Contracting a third party to complete
business processes, possibly including
the processing of personal information.
109
PCI Data
Security
Standard
```
A self-regulatory system of security
standards for payment card data drafted
by the Payment Card Industry Security
Standards Council. Compliance
necessitates companies above a certain
threshold to conduct third party
security assessments.
```
110
Perimeter
| Controls
Technologies and processes created to
secure the whole network environment
by blocking penetration from the outside.
111
Personal
| Data
What personal information is called in the
EU, defined by GDPR as any information
relating to an identified or identifiable
natural person.
112
Personal
| Information
Also called personal data, a term defined
by CCPA as information that identifies or
could be linked to a particular consumer.
113
Polygraph
A device used to render a diagnostic opinion
| on whether an individual is being honest.
114
POST
| Method
As opposed to those of the GET method,
this method’s attributes specify how form
data is given to a web page in a more
secure way.
115
Preemption
```
superior government making its law
supersede those of an inferior government,
such as the US federal government’s
declaration that no state government
can regulate consumer credit reporting.
```
116
Privacy
| Assessment
A measurement of an organization’s compliance
to its own privacy policies and procedures,
applicable laws, regulations, and industry
standards. The organization’s practices are
measured by how they alignwith legal
obligations and stated practices from
subjective information including employee
interviews and complaints, or objective standards
including logs or training attendance.
117
Privacy by
| Design
This is an approach to privacy where privacy
is embedded into technology, systems,
and practices from the early design stage
to include privacy requirements in the
processing of personal information.
It was first outlined in a framework with
seven foundational principles.
118
Privacy
| Notice
A statement provided to the data subject
explaining how an organization collects,
uses, stores, and discloses personal
information.
119
Privacy
| Officer
```
An individual designated as the head of
privacy compliance and operations in an
organization. The US federal government sees
this person as the official in charge of
the implementation and management of
all privacy and confidentiality efforts.
```
120
Privacy
| Policy
An internal statement that explains an
organization or entity’s handling of personal
information to the members of the organization
interacting with the personal information,
informing them about the collection, use,
retention, and destruction of the data and data
subject rights.
121
The
Privacy
Rule
This HIPAA rule created national standards
for the protection of individuals’ medical
records and other health information held by
health plans, healthcare clearinghouses, and
electronic healthcare providers. It requires
the establishment of safeguards to protect the
privacy of personal health information with
limits on unauthorized use and disclosure.
122
Private
Right of
Action
The individual harmed by violation of the
law may file a lawsuit against the violator
unless stated otherwise in the law.
123
Protected
Health
Information
Any individually identifiable health information
created, received, transmitted, or stored by a
HIPAA-covered entity or its business associate
or employee which can be used to identify the
individual is created or received by a covered
entity or an employer and is related to any
physical or mental condition or payment or
provision of healthcare.
124
Protective
| Order
A judge’s declaration of what information
not to be made public and the conditions
that apply for accessing the protected
information.
125
Public
| Records
Information that a government entity
maintains, obtains, and makes available
to the general public.
126
Publicity
Given to
Private Life
A statement from a US common law tort saying
that an invasion of privacy involves liability
when making something public in a manner
that is highly offensive and is not of legitimate
concern to the public
127
Qualified
Protective
Order
This prohibits both parties from using or
disclosing protected health information
for any purpose beyond the litigation, with
the understanding that at the end of litigation
the PHI will be deleted or returned.
128
Radio-Frequency
| Identification
Technologies that utilize radio waves to
identify people or things with encoded
microchips.
129
Random
| Testing
Substance testing that is only acceptable
in specific scenarios including industries
where employees have a small expectation of
privacy or as necessary for public safety or
national security. It’s sometimes required by
law but prohibited in certain jurisdictions.
130
Re-identification
The action of reapplying characteristics to
pseudonymized or de-identified data that
could be used to identify an individual.
There is risk in undoing the de-identification
actions applied to data.
131
Reasonable
| Suspicion
```
A deciding factor for allowing substance
testing as a condition of continued
employment which is based on facts and
inferences from those facts, like speech,
smell, appearance, or behavior.
```
132
Rectification
An individual’s right to have the business
or organization amend or correct their
personal data if it is inaccurate.
133
Red Flags
| Rule
A FTC regulation mandating that financial
institutions and creditors must put measures
in place to detect and prevent identity theft. It
has been amended to exclude any creditor that
provides funds on the behalf of a person for
incidental service expenses from the definition
of a creditor, which allowed some lawyers,
doctors, and other service companies to avoid
the scope of the regulation.
134
Redaction
The act of finding and covering information
from documents provided as part of a
discovery request or evidence for court
proceedings.
135
Retention
The part of the information life cycle
that pertains to organizations keeping
personal information only as long as
required to fulfill the intended purpose.
136
Right of
| Access
The right of an individual to ask and
obtain their personal data from a business
or other organization.
137
Sarbanes-Oxley
| Act
The US law ensuring transparency from
publicly held companies. As provided by the
law, public companies must create a process so
that the company can confidentially receive and
handle complaints about actual or
potential fraud due to misuse of assets
and fabrications in financial reporting from
self-exclaimed “whistle-blowers.”
138
Seal
| Programs
Programs that require participants to follow
codes of information practices and agree to
monitoring in order for the company to publish
the programs’ seal on their website.
139
Secret
| Key
A cryptographic key used in connection
to a cryptographic algorithm, which may be
uniquely and privately linked with one or
more entities. The term suggests that the
key be protected from disclosure or
substitution.
140
Sedona
| Conference
An established source of standards and
best practices for implementing data
retention policies to help keep track of
electronic discovery compliance.
141
The
Self-Regulation
Model
Models for privacy based on stakeholders
through legislation,
Enforcement, and adjudication.
142
Semayne
A case wherein the
knock-and-announce rule was established,
relating to home privacy and US Fourth
Amendment search and seizures
143
Smart
| Grid
```
An energy system that tracks electricity
use through continuous monitoring,
automation, and remote computerization
in place of the traditional electric
transmission system of physically reading
customer meters to find grid issues.
```
144
SPAM
A commercial email sent unsolicited.
145
Special
categories
of data
Article 9 of GDPR defines this as personal
information revealing things like
racial origin, political opinions, religious
beliefs, health, sexual preferences, or criminal
convictions. This information should not be
processed except in specific circumstances.
146
Stored
Communications
Act
```
This act enacted as part of the ECPA in
the US bans acquiring, altering, or blocking
electronic communications in electronic
storage facilities where this service is
provided without authorization
```
147
Subpoena
A written court order made in a civil, criminal,
or administrative case requiring the named
individual to appear in court and testify under
oath about the subject of a lawsuit, investigation,
or proceeding
148
Substance
| Testing
```
A screening to determine if drugs have
been used in settings including
preemployment, regular testing, at
will, reasonable suspicion, or
post-accident testing.
```
149
Substitute
| Notice
Allowed where notifying thousands of
impacted data subjects of a data breach
would place a burden on the organization
due to cost.
150
Telephone
Consumer
Protection Act
of 1991
```
The first law to limit unsolicited and
automated telemarketing in fax and
phone communications establishing a
private right of action for recipients, a
$500 fine per violation, and any damages
to be sustained.
```
151
Territorial
| Privacy
The class of privacy involving limitations to
the ability of a person to infringe upon
another’s environment.
152
Transfer
Sending or moving personal data from
| one organization to another
153
Transparency
Providing information about the data
processing to the datasubject in a short,
readable, and easily accessible manner,
using clear and plain language.
154
US
Department
of Labor
The US federal agency with the responsibility
to improve working conditions, advance
opportunities, and protect benefits and
collective bargaining for the welfare of job
seekers, wage earners, and retirees.
155
Unfair
Trade
Practices
Commercial behavior that knowingly
causes significant and unavoidable injury
to consumers without offsetting benefits.
156
Fair Information
Practice
Principles
Personal data record keeping systems should not be
secret. Individuals need to have a way to find out
what information about them is stored and how it
is used, to prevent their information obtained for
one purpose from being used or made available
for other purposes, and to correct or amend
their information. Any organization creating,
maintaining, using, or disclosing personal data must
assure the reliability of the data for the stated use
and take measures to prevent misuse of the data.
157
USA
PATRIOT
Act
A broad-ranging act intended to stop
terrorism which increased the authority of
US. law enforcement to capture and surveil
communications and records.
158
Value-Added
| Services
Non-core services that are outside the voice
calls and fax transmissions available at
almost no cost to promote the business.
159
Video
| Surveillance
Recordings without sound.
160
Voice over
Internet
Protocol
A technology to let phone calls be made
over an LAN or the Internet, in a similar
risk to network-connected PBX systems but
with the extra risk of data interception if
using an unsecured connection.
161
WebTrust
A self-regulating seal program to license
| certified public accountants.
162
Whistleblowing
```
Employees reporting illegal or improper
activity in the workplace to those above
them or to an outside agency.
The organization should ensure that
appropriate privacy safeguards are put
in place for the reporting employee.
```
163
Bodily
| privacy
The privacy of a
person’s
physical being.
164
Sectoral
| model
```
A privacy
framework where
laws apply to
individual industry
sectors.
```
165
U.S.
government
branches
The legislative makes laws, can override
vetoes, and comprises Senate and Congress;
the executive enforces laws, can veto congress
laws, and comprises the pres, VP, and
cabinet; and the judicial interprets laws,
determines whether laws are constitutional,
and comprises federal courts
166
Torts
Civil wrongs sanctioned by law as the
basis for lawsuits.
Types include intentional (the defendant
should have known); negligent (the defendant’s
actions were unsafe); and strict liability
(not quite carelessness but still caused
damage).
167
Offer
The proposed
language for
entering into
bargains.
168
Acceptance
The agreement
of the person to
whom the offer
is made.
169
Consideration
The exchange
that is
bargained for.
170
Person
An entity
with legal
rights.
171
Jurisdiction
The court’s
authority to
hear a
particular case.
172
Civil
| litigation
```
A court case where
one person sues
another for the
redressing of a
perceived wrong.
```
173
Criminal
| litigation
The government
is suing for a
violation of a
criminal law.
174
Administrative
enforcement
actions
```
Legal actions
pursued according
to the statutes that
create and empower
an agency.
```
175
Risks of using
personal
information
improperly
```
Legal: state, federal, and
international law regarding use
of information and sanctions;
reputational: harm to
reputation; operational: privacy
program allows business to
operate; investment: return on
investments.
```
176
Four steps of
information
management
1. Discover
2. Build
3. Communicate
4. Evolve
177
Data
| inventory
```
A record of the information
an organization collects,
stores, uses, or discloses,
and shares with other
organizations or business
affiliates.
```
178
Data
| classification
```
Data sensitivity
levels set by data
element and
combination of
data elements.
```
179
Terms that
should be
included in
vendor contracts
```
Confidentiality, no further
use of shared information,
use of subcontractors,
breach notifications,
information security
provisions, and end of
relationship.
```
180
Standards
for vendor
selection
```
Consider the vendor’s
reputation, financial condition
and insurance, incident
response, information security
controls, audit rights, employee
training, point of transfer, and
disposal of information.
```
181
FACTA
Disposal
Rule
This rule establishes requirements for
| the disposal of personal information
182
Online
privacy
threats
Social engineering, malware, data
| transfer and access, and phishing
183
Layered
| notice
A privacy notice with sections of
different lengths--a shorter version
with key points and a longer, more
detailed version.
184
Sale under
| CCPA
Disclosure of personal information to
another organization for any type of
value, monetary or otherwise.
185
Notice
requirements
under CCPA
A notice should be posted before collection,
be located on the website, list the rights
of consumers, and include an option to
opt out of sale.
186
Personal
information
under CCPA
Things like name, email, IP address,
employment information, biometrics,
and geolocation, but not deidentified
information.
187
CCPA data
subject
rights
These include the rights to receive the
information that was collected, delete,
and opt out of sale of their information.
188
C.I.A.
| triad
```
Confidentiality: access limited to
authorized parties; Integrity: data
authenticity; and Availability:
data made accessible to
authorized parties.
```
189
Physical
| controls
A type of security control using things
| like locks and security cameras.
190
Administrative
| controls
A type of security control using things
| like incident response plans and training.
191
Technical
| controls
A type of security control using things
like firewalls, access logs, and
antivirus software.
192
Incident
management
steps
1. Determine whether a breach has occurred
2. Contain and analyze the incident
3. Notify affected parties
4. Implement follow-up methods
193
Electronic
protected health
information
(ePHI)
PHI contained in electronic media.
194
Protected
health
information
(PHI)
Individually
identifiable
health
information.
195
HIPAA
Privacy Rule
protections
Include things like privacy notice,
authorization for uses and disclosures,
minimum necessary use or disclosure,
safeguards, and accountability.
196
HIPAA
Security
Rule
```
This requires covered entities and
business associates to ensure the CIA of
all ePHI obtained, including protection
from reasonably anticipated threats,
unpermitted use or disclosure, and
noncompliance with the Security Rule.
```
197
21st Century
Cures Act of
2016
This act expedited research for new medical
devices and prescription drugs, sped up the
process for drug approval, and reformed mental
health treatment. It allowed researchers to view
PHI remotely, prohibited information blocking,
and allowed sharing mental health or substance
abuse information with family and caregivers.
198
Gramm-Leach-Bliley
| Act Privacy Rule
```
A rule mandating that financial institutions
provide notice of information-sharing
practices to customers; allow customers
the right to opt out of sharing; avoid
giving account numbers to third parties;
and protect the confidentiality and
security of customer information.
```
199
Gramm-Leach-
Bliley
Act scope
U.S. financial institutions or companies
significantlyengaged in financial activities,
like banks, mortgage lenders, insurance
providers, and credit advisors.
200
Gramm-Leach-
Bliley
Act Safeguards
Rule
```
A rule requiring that financial institutions
create and implement an information
security program with administrative,
physical, and technical safeguards to
protect the integrity, security and
confidentiality of customer information.
```
201
Family
Educational
Rights and
Privacy Act
A federal statute that allows students and
parents control over how education
records are accessed and shared.
202
Student rights
under the Family
Educational Rights
and Privacy Act
The rights to review and seek amendment
of their education records, to control the
sharing of their education records, to
receive annual notice of their rights, and
to file complaints with the US Department
of Education
203
Family Educational
Rights and Privacy
Act: education
record
All records that are directly related to the
student and kept by the school or on behalf
of the school. This excludes campus police
records, employment records, applicant
records, alumni records, and grades
on peer-graded papers.
204
Family Educational
Rights and Privacy
Act: personally
identifiable information
Student name, student or family address,
parent or family member names, personal
identifiers, date of birth, and other
information that could be used to identify
a student or information requested by a
person who is believed to know the identity
of a student.
205
Family Educational
Rights and Privacy
Act: directory
information
```
Information that if disclosed would not be
considered an invasion of privacy or
harmful to the individual. A student
should be allowed to opt out of this
information being shared.
```
206
Telemarketing
| Sales Rule
A rule issued by the FTC establishing
| guidelines for making telemarketing calls.
207
Telemarketing
Sales Rule
requirements
Covered organizations must display
caller ID, only call between 8am and 9pm,
identify themselves and the product,
disclose all material information, check
numbers against the DNC list, respect
requests to call back, retain records for
at least 24 hours, and comply with
automated dialer, prize, and promotion rules.
208
Telemarketing
Sales Rule
covered
organizations
Telemarketers and sellers, or entities
engaging in calls from consumers or
providing goods and services offered,
respectively.
209
Telemarketing
Sales Rule:
telemarketing
A campaign, plan, or program to illicit
a purchase of goods, services, or
charitable contribution with one
or more interstate phone calls.
210
```
Controlling the
Assault of
Non-Solicited
Pornography and
Marketing Act of 2003
```
An act that established rules for
unsolicited commercial e-mail and a
mechanism to allow individuals the right
to opt out of undesired communications.
211
```
Controlling the Assault
of Non-Solicited
Pornography and
Marketing Act of 2003
scope
```
AAnyone who advertises products or
| services by e-mail to or from the US.
212
```
Controlling the Assault
of Non-Solicited
Pornography and
Marketing Act of 2003
requirements
```
```
Conspicuously display a return email
and mailing address, notice of the right
to opt out and a mechanism to do so,
identification that the message is
commercial, and a warning
for any sexually oriented material.
```
213
Wireless
Domain
Registry
The FCC’s registry of wireless domain
names for senders to consult and check that
they have authorization before
sending commercial messages.
214
Controlling the Assault
of Non-Solicited
Pornography and
Marketing Act of
A commercial e-mail message sent to a
wireless device used by a commercial
mobile service subscriber.
215
Effects of the
Telecommunications
Act of 1996
Reshaping telecommunications markets,
promoting the privacy privacy of customer
information and CPNI held
by telecommunications carriers, and
requiring consent for telecommunications
carriers to sell consumer data to third parties.
216
Customer
proprietary
network
information
Information related to subscribers as
| collected by telecommunications carriers.
217
The latest
CPNI
requirements
```
2007 CPNI order, which requires that
customers receive the right to explicitly
opt in before carriers share CPNI with
contractors or joint venture partners
for marketing purposes.
```
218
Cable
Communications
Policy Act of
1984
```
This act regulated the notice that cable
television providers have to make to
customers along with their ability to
collect, retain, and delete
personal information.
```
219
Video Privacy
Protection Act
of 1988 scope
Video tape service providers, which
would be anyone engaged in the business
of sale, commerce, rental, or delivery of
audio-visual materials, and anyone who
receives personal information as part of
the video tape service provider’s business.
220
Video Privacy
Protection
Act of 1988
An act that set destruction and retention
requirements for personal information
collected by videotape service providers,
prohibited the disclosure of customer
personal information and established a
private right of action.
221
Electronic
Communications
Privacy Act
```
An act including emails and stored
records in the ban on the interception
of electronic communications that was
passed after the Supreme Court ruled that
the Fourth Amendment did not apply to
phone numbers called.
```
222
Right to
Financial
Privacy Act
An act stating that government authority may
not have or obtain access to copies
of information in the financial records of
any financial institution customer without
consent, subpoena, warrant, summons, or
formal written request from an
authorized government authority.
223
Bank
Secrecy
Act
An act preventing criminals from using f
inancial institutions to launder or hide
money they obtained illegally.
224
Cybersecurity
Information
Sharing Act of
2015
An act allowing the federal government to
share unclassified technical data network
attacks and successful defenses with
companies.
225
Redaction
Identifying and removing or blocking
information from documents relevant to a
court proceeding or discover request, in this
case personally identifiable information.
226
Stored
Communications
Act of 1986
```
Enacted as part of the ECPA, an act
that prohibited unauthorized acquisition,
alteration, or blocking of electronic
communication in electronic storage for
electronic communications service.
```
227
Communications
Assistance to
Law Enforcement
Act of 1994
Also called the “Digital Telephony Bill”, this
act lists the responsibilities of players in the
telecommunications industry to cooperate
with law enforcement in interception
requests for communications and
other needs.
228
Electronic
Communications
Privacy Act: pen
register
The ECPA allowed these kinds of orders
from a judge so long as they are relevant to
the investigation.
229
Privacy
Protection
Act of 1980
This act protects media and organizations
from government searches or seizures
in criminal investigations, requiring law
enforcement to submit subpoenas or
illicit voluntary cooperation for evidence.
230
Cybersecurity
Information
Sharing Act of
2015 provisions
These include the authorizations to share and receive
cyberthreat indicators or defense measures, for the
company to use monitoring and defense measures to
redact personal information before it’s shared, the fact
that sharing information with the government only
exempts it from FOIA, restriction from using shared
information for enforcement actions, and safety from
liability for monitoring activities..
231
Privacy
Protection Act
of 1980 scope
This act applies to government officers
and employees and only criminal
investigations.
232
National
Security
Letters
A category of subpoena whose use
widened with the USA PATRIOT Act.
Reforms have been related to indefinite
secrecy on receiving companies.
233
GDPR
| requirements
Controllers must appoint a DPO, implement
privacy by design, report data breaches, cooperate
with the DPA, identify the legal basis for
processing, conduct DPIAs, maintain ROPAs,
seek informed consent before collecting data, and
allow data subjects with the opportunity to exercise
all required rights. Processors must agree
to confidentiality, data security, data breach
reporting, and cooperation with the DPA.
234
GDPR data
subject
rights
Data subjects have the rights to be informed
of transparent communication and information,
to access their data, to rectify their data, to be
forgotten, to restrict the processing of their data,
to data portability, to object, and not
to be subject to automated decision-making.
235
Key differences
| among states
CCPA/CPRA: enforced by attorney gen; CA residents; rights to know, delete, opt out of
sale, opt in to sale under 16, non-discriminatory treatment, private right of action, correct,
and limit use and disclosure; applies to service providers, third parties, contractors, and
businesses in California with revenue over $25 million/selling/sharing PI of 50k/50% of
annual revenue from sale. ColOPPA: controllers with business/targeting CO and 100k
consumer data or sells data and has 25k consumer data; rights of access, correction, deletion,
data portability, opt out of targeted ads, sale, and profiling; DPIAs. Nevada: applies to
owners/data brokers with a website, PI from Nevada consumers, and directs activity toward
Nevada; no PRA; 30 day cure period; no guidance on how notice should be given. OPPA:
businesses with $25 million revenue in OH or controlling/processing large data sets; rights
to delete and to opt out of sale; notice requirements; 30 day cure period; no PRA. Vermont:
applies to data brokers; opt out of sale; DPIA for processing minors’ data. VCDPA: rights to
know, access, delete, correct, data portability, and opt out of targeted ads, sale, and profiling;
DPIAs required; applies to entities doing business in Virginia with PI of 100k consumers or
25k while receiving 50% of revenue from sale; no PRA; 30 day cure period. UCPA: no PRA
or DPIAs; Utah residents; 30 day cure period; 100k Utah consumers’ PI and $25 m
236
Utah
Consumer
Privacy Act
This is similar to VCDPA. It applies to businesses
making over $25 million annual revenue and either
holding the data of 100,000 Utah consumers or
deriving 25% of revenue from the sale of 25,000
consumer’s data. It establishes a 30-day cure period
and 45 days to respond to data subject access
requests. There is no private right of action or
requirement for DPIAs Enforcement will go to Utah
Department of Commerce’s Consumer Protection
division and the attorney general’s office.
237
Cookie
| regulations
GDPR considers cookies to be personal
| data, so consent is required before collecting.
238
SSN
| laws
Federal laws place limits on the
disclosure of SSNs; California, for example,
has laws prohibiting businesses from
posting or printing SSNs.
239
Data
destruction
laws
Some common elements between states
include the scope of government and private
businesses, exemptions to other laws
like GLBA and HIPAA, penalties, and notice.
Some differences include only paper records
in AZ; private right of action in AL; and using
any means to make data unreadable in CA.
240
California
Electronic
Communications
Privacy Act
This act requires CA law enforcement to
produce a warrant before viewing
electronic information about residents.
241
Delaware
Online Privacy
and Protection
Act
This act requires operators to conspicuously
post privacy policies on the website stating the
categories of PII collected and the categories
of third parties with whom the information
is shared. It also prohibits promoting alcohol,
tobacco, and other substances to children under
the age of 18.
242
Nevada
| SB 538
This bill establishes provisions related to
the information and services of immigrants
in this state, where each regulatory
body is required to create an online
resource for immigrants informing them
how to obtain a license or similar
authorization for certain occupations.
243
Illinois
Right to
Know Act
This act requires websites and applications
to notify Illinois customers of PII collected
about them and with whom they share
that PII. It does establish a private right
of action.
244
NJ Personal
Information and
Privacy
Protection Act
This act limits the purposes for which
retail establishments can scan a person’s
government identifier and limits use
and retention of scanned data.
245
Washington
Biometric
Privacy Law
This statute allows commercial use of
biometrics only with consent, except for
disclosure for specific financial transactions
or at the requested of the individual.
246
NYDFS
Cybersecurity
Regulation
A set of regulations of requirements
created to assess and develop plans to
address covered financial institutions’
cybersecurity risks. It applies to all entities
that operate under DFS licensure, registration,
or charter and all their service providers.
247
Virginia
Consumer Data
Protection Act
This act applies to entities doing business/
targeting Virginia residents that have the
PII of 100k consumers or 25k consumers
while deriving 50% of their revenue from the
sale of this data. Rights include access,
deleting data, and opting out of targeted
advertising and sale of personal information.
It also includes requirements for DPIAs and
sets a 30-day cure period. Entities have
45 days to respond to DSARs
248
Ohio
Personal
Privacy Act
This act applies to businesses with
$25 million revenue in OH or controlling/
processing large data sets. It provides rights
to delete and opt out of sale. It sets
requirements for privacy notices and
a 30-day cure period.
249
Nevada
Revised
Statutes
Chapter 603A
This revision applies to data brokers and
operators who own/operate websites for
business, collect PI from Nevada consumers,
and direct activities toward Nevada.
It allows a 30-day cure period.
250
Vermont Data
Brokers and
Consumer Act
This act applies to data brokers selling and
collecting data about consumers with whom the
business doesn’t have a direct relationship. Its
requirements include allowing consumers
to opting out of sale of their personal
information and conducting DPIAs before
processing minors’ personal information.
251
Colorado
| Privacy Act
This act applies to controllers with business
operating in CO or targeting CO and
maintaining the consumer data of 100,000 or
receiving revenue from selling the consumer
data of 25,000. It provides CO residents the
rights of access, correction, deletion, data
portability, opt out of targeted ads, sale, and
profiling. Controllers have 45 days to
respond to DSARs. It also requires DPIAs.
252
Federal vs
state
authority
The federal government has the power or
authority to regulate all states, and the state
government has the power or authority to
regulate the ongoings inside each state.
253
Human
resource
management
The practice of managing people to achieve
better performance while following
confidentiality requirements about
management or business information.
254
Occupational
Safety and
Health Act
An act overseen by the Dept of Labor
| which regulates workplace safety.
255
Securities and
Exchange
Commission
```
The commission that oversees
investment advisors, securities brokers
and dealers, securities exchanges, and
mutual funds to promote fair dealing
and transparency of market information
and prevent fraud.
```
256
Civil Rights
| Act of 1964
The US law banning discrimination on
the basis of religion, race, color, sex, or
national origin in hires, promotions,
and terminations.
257
Americans with
| Disabilities Act
```
A federal civil rights law banning
discrimination against those with
disabilities in activities including
purchases, employment opportunities,
and government programs.
```
258
Genetic
Information
Nondiscrimination
Act
```
This act prevents employers from
making job-related decisions using
genetic health information; for example,
health insurers determining the eligibility,
cost, coverage, or benefits of a policy.
```
259
```
Employee
background
screening
requirements under
FCRA
```
The FCRA regulates the use of consumer reports
from consumer reporting agencies to be used in
background checks. The company conducting
the background check should only obtain a
consumer report under certain purposes including
employment. They should provide written notice to
the applicant, obtain written consent, obtain data
only from a qualified CRA, certify their permissible
purpose to the CRA, and provide pre- and postadverse-
action notices if applicable
260
Methods of
employee
background
screenings
Examples include psychological testing,
polygraphs (only allowed in certain
occupations), and substance testing (needing
reasonable suspicion in some states).
261
Employee
monitoring
technologies
Methods include social media, video
surveillance, information technology, stored
communications, location-based services,
monitoring mail, and bring-your-own-device.
262
Employee
monitoring
requirements
under ECPA
ECPA establishes that employers must
generally obtain consent from at least one party
before monitoring or recording company
calls. The interception of wire, oral, and
electronic communications is typically not
allowed outside of the course of business.
263
Potential issues
with investigations
of employee
misconduct
```
Be cognizant of taking allegations
seriously, documenting the misconduct,
treating employees with fairness during
the investigation, and considering laws,
policies, and employee’s rights.
```
264
Records
retention after
employment
```
In some jurisdictions, there should
be a demonstrable business or legal reason
to retain specific personal information
after termination, which could be to
provide references, respond in legal
proceedings, or follow
retention requirements.
```
265
California
Shine the
Light law
This act requires businesses in California
to disclose what personal information the
business has shared with third parties
and name the third parties. It applies to
businesses that have established
relationships with California
resident-consumers and disclosed their
PII to a third party company for direct
marketing.
266
California
Online Privacy
Protection Act
This act requires commercial websites and
online services collecting and storing PII
from CA consumers to post a conspicuous
privacy policy that links from the home page.
Amendments in 2013 added the requirement
to disclose cookies and tracking.
267
PRIVACY REF Info?
PRIVACYREF.COM
888-470-1528
INFO@PRIVACYREF.COM
