Part 2 Flashcards

(36 cards)

1
Q

What are common appropriate safeguards for data transfer for countries without EU GDPR adequacy decision?

A

Binding corporate rules, standard contractual clauses, derogations, codes of conduct, certification mechanisms, ad hoc contractual clauses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Business Associate Agreement

A

contract outlining how a business associate will handle PHI on behalf of covered entity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Partnership Intermediary Agreement

A

contract, agreement, or memorandum of understanding with a non-profit partnership intermediary to engage academia and industry on behalf of government to accelerate tech transfer and licensing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Comptroller of Currency

A

charters, regulates, supervises all national banks, federal savings associations, as well as federal branches and agencies of foreign banks

Head of Office of the Comptroller of the Currency (OCC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

CA State Privacy Laws

A

CCPA + CPRA
- give consumers more control over PI

Requires:
extensive transparency and disclosure obligations. Right to not be discriminated against for exercising rights

Enforced by: CPPA (CA Privacy Protection Agency) and AG of CA

Violations: penalties up to $7500 per, if unintentional = $2500

covers:
- for-profit businesses in CA (Gross Annual Revenue > 25M)
- buy/sell/share private info of 100k or more CA residents/households/devices, OR derive 50% of their annual revenue from selling CA residents’ PI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

When can covered entities disclose under VPPA?

A

with written consent or to fulfill order, request processing, transfer of ownership/ debt collection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Data Flow Map

A
  1. Data ID to be mapped
  2. ID data sources
  3. Gather info on how it was collected, used stored, transferred
  4. Connect data process. establish responsible parties
  5. Create data inventory
  6. Get collaborative (involve multiple people to ID system interfaces, quality assurance groups)
  7. Collection data processing locations (find out how)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Where is legislative focus and concern in privacy?

A

consumer rights

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

FIPs

A

fair info practices
- set of guidelines for handling, storing, protecting and managing PI
- provide framework for most privacy laws around the world

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What do cookies do?

A

help web/ ad network track user’s browsing acts potentially across multiple websites visited

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Common sources of data breach

A
  • criminal hacking
  • human error
  • social engineering
  • malware
  • unauthorized use
  • physical actions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

FAST Act

A

part of Fixing America’s Surface Transportation Act Amendment

Establishes exception to annual privacy notice requirements to if you meet the criteria, don’t need to provide notice to customers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What international data transfer method was invalidated as a result of Schrems I?

A

EU-US Safe Harbor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Tort

A

civil wrong recognized by law as having grounds for lawsuit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Examples of self-regulatory system for managing privacy compliance within US regulations/ US industry best practices

A

AdChoices, TrustArc Privacy Certification, Payment Card Industry Data Security Standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

When may substance-use testing occur?

A
  • pre-employment
  • reasonable suspicion
  • routine, post-accident or random

NOT regulated by federal law
Excludes illegal drug use from protections

Certain restrictions, but federal law MANDATES it for certain positions like US Customs and Border Protection, aviation, railroading and trucking industries

17
Q

Layered Notices

“Just in time” notices

Privacy dashboard

A

layered - provide key points in a short notice but give users option to read a detailed notice or click through to greater detail

Just in time - notice of privacy policies are given at or before the point of info collection

Privacy dashboard - offers summary of privacy-related info in format intended to be easy to access and navigate

18
Q

Difference between a business associate and a business vendor under HIPAA

A

business associate - vendor that needs access and use protected health info to perform services for covered entity

Business vendor - any company providing goods/ services to a covered entity but does not necessarily require access to PHI

Key diff: whether they handle PHI

19
Q

Who handles data breach notification enforcement?

20
Q

If an employer denies employment based on a CRA report, they must:

A

Issue a notice that an adverse action was taken

21
Q

What is the FERPA request for access response deadline

A

Within 45 days of receiving the request

22
Q

What are the 3 laws the department of labor oversees?

A

FLSA, OSHA, ERISA

23
Q

Types of Cookies

A

session (essential) remember activities on one site

Persistent - permanent, expiration date determined by expiration date over when the user deletes cookies

3rd party - used to track user acts across internet (ads)

Zombie - tracks data even after cookies are deleted

Secure - can’t be accessed by malicious software/ unauthorized parties

24
Q

GLBA Security Levels

A

established through Safeguards Rule — mandates financial institutions to implement computer info security programs (3 key areas):
Physical (secure access controls to facilities), technical (encryptions, firewalls), administrative (employee training, security policies, incident response procedures)

25
What jurisdiction must courts have to hear a particular case?
personal and subject matter
26
Illinois v. FB
$650M settlement of privacy lawsuit against FB for violating BIPA (biometric info privacy act) by failing to obtain consent before harvesting pics of face and other biometric data Under settlement, FB will implement changes like setting “face recognition” default setting to off
27
Data brokers
companies that collect, use and sell PD without consumer’s knowledge
28
CA-CPPA
propose regulations that would require risk assessments and pre-use notices, access requests, and opt-out requests when automated decision-making tech (ADMT) is used in certain ways: - decisions that produce legal/similar significant effect on consumer - profile consumer - process info to train ADMT
29
CO Privacy Act Rules
similar to CPPA- requires pre-use notice, opt-out rights and risk assessments when ADMT systems are used for profiling
30
Every Student Succeeds Act
3rd amendment to FERPA (2015-now) Replaced no child left behind act Reauthorized elementary and secondary education act of 1965 - student info will NOT be shared with individuals outside school without notice to parents - secretary requires assurance that each grantee receiving funds under act understands importance of privacy protections and aware of responsibilities of the grantee
31
No Child Left Behind Act
2nd amendment to FERPA Broadened PPRA by putting requirements on schools to enact collection, disclosure, or use policies about a student’s PI for communication purposes Requires: - provide advance notice about acts scheduled - provide parents the right to opt out of surveys/ sharing student PI for communication purposes - allow parents to access and inspect surveys and other commercial instruments before administering to students
32
FISA
Foreign Intelligence Surveillance Act - established standard procedures for use of e-surveillance and collection of foreign intelligence in US - need gov to get permission from judge on FISA court for national security reasons - allows warrantless surveillance without a court order up to 1 year only for foreign intelligence info, target foreign powers, and doesn’t capture contents of communications with any US person
33
Federal requirements for data security
Only health care and financial sectors have federally imposed info security provisions FTC uses its section 5 power to bring actions against companies misrepresenting info security practices or failing to provide “reasonable procedures” to protect PI
34
ERISA
Employee Retirement Income Security Act Ensures that employee benefits programs are created fairly and administered properly
35
FERPA
Federal Educational Rights and Privacy Act (Buckley Amendment) - federal statute providing students with control over disclosure and access to student records - applies to all educational institutions receiving funding from Dept of Education - enforced by Dept of Education Vio: loss of funding Requires: students receive annual notice of rights, schools MUST have WRITTEN permission from parents to release info from edu record - students can access and review records, request corrections, have hearing if corrections are denied - reasonable methods used to ensure only access to records with legit educational interests
36
USA FREEDOM ACT provisions
- prohibits FBI from applying for tangible thing production order unless specific selection term used as basis for it - NO pen register or trap and trace for bulk data collection - government mut issue yearly transparency report of FISA orders and NSLs - requires targeted warrants from FISA court before cell phone meta data collection