Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CIPP Exam > State Privacy Laws > Flashcards

State Privacy Laws Flashcards

1
Q

Illinois Biometric Info Privacy Act (BIPA)

A

passed in 2008

most high profile biometric privacy law

applies to
1. biometric identifiers- retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry
2. biometric info- info based on individuals biometric identifier and used to identify individual

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

BIPA requirements

A
  1. must give notice to individual prior to processing info (include length of time it will be collected/stored before processing biometric identifiers or biometric info)
  2. obtain written release from data subject before collection
  3. no sale of biometric data
  4. disclose only in limited situations
  5. meet requirements for storage + publicly available policy for retention
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

BIPA enforcement

A

private cause of action

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Texas Capture or Use of Biometric Identifier Act (CUBI)

A
  1. need consent to
    - capture biometric identifier of individual for commercial purposes
    - sell, lease, or disclose that biometric identifier to 3rd party
  2. use reasonable care in storing data
  3. destroy data no later than 1 year after purpose for collecting identifier expires
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

CUBI enforcement

A

TX attorney general

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Washington Biometric Privacy Law

A

passed in 2017

company may not enroll biometric identifier into database for commercial purposes unless
1. adequate notice provided +
2. consent received +
3. mechanism is put in place to prevent subsequent use of info for commercial purposes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Virginia Consumer Data protection Act (VCDPA)

A

2nd state to implement comprehensive privacy legislation (behind CA)

applies to
1a. any person conducting business in VA
1b. any person that produces products/services targeted at VA residences
+
2a. processes personal data of at least 100,000 consumers or
2b. controls/processes personal data of at least 25,000 consumers and derives over 50% of gross revenue from sale of personal data

no revenue threshold (different from CCPA)

doesn’t apply to
- organizations subject to GLBA or HIPAA
- nonprofits
- higher education institutions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

VCDPA consumer rights

A
  1. access
  2. confirmation whether processing their data
  3. amend
  4. delete
  5. obtain copy
  6. opt out
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

VCDPA enforcement

A

VA attorney general

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Colorado Privacy Act (CPA)

A

3rd state to enact comprehensive privacy legislation

applies to
1a. persons that conduct business in CO or
1b. persons that produce/deliver commercial products/services intentionally targeted at CO residents
+
2a. control/process data of 100,000 consumers or more during 1 year
2b. sell personal data and process/control data of 25,000 consumers

doesn’t apply to
- organizations subject to HIPAA, GLBA< COPPA, FERPA etc
- data maintained for employment records purposes
APPLIES TO NONPROFITS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

CPA controller responsibilities

A
  1. transparency (privacy notifications)
  2. purpose specification
  3. data minimization (only what is reasonably necessary)
  4. care
  5. avoid unlawful discrimination
  6. consent
  7. safeguards
  8. processor contracts (processor must adhere to controller instructions and can’t engage in subcontracts unless controller opt to object)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

CPA data subject rights

A
  1. access
  2. amend
  3. delete
  4. opt out
  5. appeal action on requests to exercise rights
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

CPA enforcemen

A

CO attorney general and local district attorneys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Nevada Privacy Act

A

applies to personally identifiable info obtained from internet or online service maintained by operator of website or data broker

doesn’t apply to
1. CRA
2. processing for fraud prevention
3. personal data publicly available
4. data regulated by DPPA or GLBA or FCRA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Nevada Privacy Act requirements

A

must provide online privacy notice

operators and data brokers must establish designated request address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Nevada Privacy Act

A

NV attorney general

17
Q

Connecticut Data Privacy Act

A

applies to
1. any business operating in Connecticut
1b. any business targeting goods/services to CT residents
+
2a. process personal data of at least 100,000 consumers or
2b. process personal data of 25,000 consumers and derive over 25% of its gross revenue from sale of personal data

doesn’t apply to
1. personal data deidentified or publicly available
2. processing done solely for payment transactions

18
Q

Connecticut Data Privacy Act data subject rights

A
  1. access
  2. correct
  3. delete
  4. data protability
  5. opt out
19
Q

Connecticut Data Privacy Act enforcement

A

CT attorney general

20
Q

Utah Consumer Privacy Act

A

controllers or processors that
1. conduct business in Utah or target consumer in UT
2. have annual revenue of 25 million (revenue threshold)
3. either
- process personal data of 100,000 or more consumers or
- process personal data of 25,000 and derive 50% of gross revenue from sale of personal data

doesn’t apply to aggregated data (relates to group or category of consumers which individual identification is removed)

21
Q

UDPA rights of data subject

A
  1. delete
  2. opt out

no right to correct inaccurate data

22
Q

UDPA enforcement

A

UT attorney general

division of consumer protection administers system to receive consumer complaints and refers matter to AG if believe violation exists

23
Q

Iowa Consumer Data protection Act (ICDPA)

A

6th state to enact comprehensive privacy legislation

effective in 2025

applies to
1. entities that conduct business or target consumers in Iowa
2. process or control data
- data of 100,000 IA consumers or
- personal data of at least 25,000 IA consumers and derive more than 50% of their gross revenue from selling personal data

24
Q

ICDPA data subject rights

A
  1. notice
  2. opt out
  3. access
  4. obtain copy
  5. delete

no right to correct data or opt out of profiling or automated decision making

no assessments needed to be made by businesses

25
Q

ICDPA enforcement

A

IA attorney general

26
Q

Delaware Online Personal Privacy Protection Act (DOPPA)

A

broader than COPPA

applies to children under age of 18 (not under 13 as in COPPA)

prohibits advertising related to tobacco, firearms, tanning equipment, etc towards children

requires privacy policy notice posted on website that collect personal information

27
Q

Illinois Student Online Personal Protection Act (SOPPA)

A

most comprehensive state level privacy legislation applicable to student records or education industry

applies to covered info - personally identifiable info that is not publicly available dn is created by or provided to operator of education tech service by student, parent or school

28
Q

SOPPA- operator of education services requirements

A
  1. no
    - targeted ads
    - profiling of students
    - selling student data or
    - disclosing covered info
  2. implement reasonable security practices
  3. delete info within reasonable time or upon request
  4. privacy notice
  5. written contracts with schools before receive covered info
  6. notify school of any breach of students covered info
  7. provide schools list of 3rd party vendors covered info is shared with
29
Q

SOPPA- schools requirements

A
  1. no selling or disclosing covered info unless to parent or school board member
  2. make expansive disclosures about personal info collected, data breaches, that are posted on school website
  3. implement reasonable security procedures
  4. designate school privacy officer
30
Q

SOPPA- state board of education

A
  1. no selling or disclosing student data
  2. must public data about vendors and covered info it maintained
  3. develop model student data privacy policy and procedure
31
Q

data breach notification laws

A

all 50 states have data breach notification laws (no federal law)

CIPP Exam (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions