CIPP-US > GDPR, DOI, and Data Leaks > Flashcards

GDPR, DOI, and Data Leaks Flashcards

Compare U.S. and EU data protection principles and understand disclosure obligations in the event of data breaches. (84 cards)

Study These Flashcards
1
Q

What was the purpose of the 1995 Data Protection Directive?

A

Set the foundation for EU data privacy laws.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What was the Safe Harbor Agreement?

A

2000 U.S.-E.U. agreement allowing data transfers if US companies followed EU-like privacy protections.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Why was Safe Harbor invalidated?

A

Schrems I case following Snowden’s 2013 revelations about NSA surveillance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What replaced Safe Harbor in 2016?

A

E.U.-U.S. Privacy Shield

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What happened in Schrems II?

A
  • CJEU ruled Privacy Shield invalid
  • SCCs still valid with conditions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the E.U.-U.S. Data Privacy Framework?

A

2023 agreement addressing concerns from Schrems II, includes EO 14086.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is EO 14086?

A
  • US EO ensuring surveillance is necessary/proportional
  • Creates data protection review court
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a ‘third country’ under EU law?

A

Country outside EEA without an adequacy decision.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the three legal bases for EEA data transfers?

A
  • Adequacy decision
  • Appropriate safeguards
  • Derogation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are Standard Contractual Clauses ?

(SCCs)

A

Contractual promises by companies to follow EU data protection law.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are Binding Corporate Rules?

(BCRs)

A

DPA-approved rules allowing intra-group data transfers under strict conditions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a derogation under EU data transfer rules?

A

Legal exception

Examples: explicit consent or legal necessity, for occasional transfers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the Global CBPR Forum?

A

Cross-border privacy certification system, based on APEC principles.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What does the OECD Declaration on Data Access cover?

A

Government access to private data.

Examples: legal basis, transparency, oversight, remedies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the GDPR?

A
  • General Data Protection Regulation
  • EU regulation on information privacy applicable to EU/EEA, effective 2018
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which countries are part of the EEA?

A

EU + Norway, Iceland, Liechtenstein

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are key provisions of GDPR?

A
  • Data processing rules
  • Individual rights
  • Breach notification
  • DPO requirement
  • Penalties
  • Transfer rules
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is personal data under GDPR?

A

Data related to an identified or identifiable person.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is sensitive personal data?

A
  • race
  • politics
  • religion
  • unions
  • genetics
  • biometrics
  • health
  • sexuality
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is required to process sensitive data?

A

Explicit consent for specific purpose.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Who is a data subject?

A

The individual whose data is collected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the four consent requirements under GDPR?

A
  • Freely given
  • Specific
  • Informed
  • Unambiguous
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What info must be disclosed by data controller for informed consent?

A
  • Controller identity
  • Purpose
  • Data collected
  • Right to withdraw
  • Automation
  • Transfer risks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is a Data Protection Authority?

(DPA)

A

Independent national bodies that enforce GDPR and offer guidance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What is a **Data Protection Officer**? | (DPO)
**EU-based privacy contact** with relevant experience and no conflicts; required in certain cases.
26
What must **non-EU businesses** do under GDPR?
Appoint an **EU representative** if no EU office exists.
27
What are the **seven GDPR principles**?
* Lawfulness, fairness, and transparency * Purpose limitation * Data minimization * Accuracy * Storage limitation * Integrity and confidentiality * Accountability
28
What does **lawfulness, fairness, and transparency** mean in GDPR?
Legal basis for processing, informing data subjects, and clear communications.
29
What is the **purpose limitation** principle?
Data must be collected for specific, explicit, legitimate purposes
30
When is **secondary processing** allowed under GDPR?
If **compatible with original purpose**, data subject expectations, safeguards in place.
31
What does **data minimization** mean?
* Collect only necessary data * Delete when no longer needed
32
What is required by the **accuracy** principle?
Data must be correct, complete; allow for corrections.
33
What does **storage limitation** entail?
Keep data only as long as **necessary**.
34
What does **integrity and confidentiality** mean?
* Authorized access only * Data must be accurate, complete, secure, and available when needed
35
What does **accountability** mean under GDPR?
Controller must **demonstrate compliance** through records, breach logs, DPIAs, user access.
36
What is the **mnemonic for GDPR principles**?
Llamas Paraded Drowsily As Smurfs Imploded Accidentally ## Footnote Lawfulness, Purpose, Data, Accuracy, Storage, Integrity, Accountability
37
What is the **mnemonic** for GDPR data subject rights?
Real adorable pandas eat avocados in overalls. ## Footnote Restrict, ADM, Portability, Erasure, Access, Informed, Objection.
38
When does the **right to restrict processing** apply?
Disputed accuracy, unlawful processing, no longer needed, subject objects.
39
What is **automated decision making**? | (ADM)
* Solely automated processing of data without human involvement, AND * Produces legal effects ## Footnote Allowed with contract, law, or explicit consent.
40
What is **data portability**?
* Right to receive or transfer data in machine-readable format * Applies with consent/contract + automation
41
What is the **right of erasure**?
* Right to be forgotten * Applies when data is no longer needed, consent withdrawn, objection, unlawful, legal obligation, or child’s data
42
What does the **right of access** and **rectification** involve?
Request confirmation, copy, privacy notice, and correct inaccurate data.
43
What types of notices **support the informed right**?
* Layered * Just-in-time * Dashboard
44
What does the **right to object** cover?
Processing for direct marketing, legitimate/public interest (not absolute).
45
What factors are considered in the legitimate interest **balancing test**?
* Data nature * Expectations * Impact * Safeguards * Relationship * Method * Benefits
46
What are **controller obligations** when responding to data subject requests?
* Respond in 1–3 months * Verify identity * No fee/refusal unless burdensome
47
When can a subject **bring a complaint to court**?
If unsatisfied with DPA or no resolution in three months.
48
**Who is liable** under GDPR?
Controllers and processors ## Footnote Both liable for harm caused; joint controllers share liability
49
What are the **high-tier** GDPR fines?
Up to 4% global revenue ## Footnote For consent violations, rights violations, unlawful processing/transfers.
50
What are the **low-tier** GDPR fines?
Up to 2% global revenue ## Footnote For poor recordkeeping, DPA cooperation, DPO designation, security issues
51
What is a GDPR **data breach**?
Breach of security causing loss, destruction, disclosure, or access to personal data.
52
**When** must a controller report a data breach?
Within **72 hours** of **becoming aware**, unless risk is unlikely.
53
When must a processor **notify the controller** of a breach?
Without undue delay.
54
What must be included in a data subject breach **notification**?
* Plain language * DPO contact info * Breach consequences * Mitigations in place
55
When is breach notification to subjects **not required**?
* Low risk * Mitigation taken, or * Public notice used due to burden
56
What is a **Department of Insurance**?
* A **state-level** government regulatory agency * Supervises and **regulates** the insurance industry ## Footnote E.g., homeowners auto health life and disability insurance.
57
Who **heads** each state's Department of Insurance?
An Insurance Commissioner
58
What are the **primary responsibilities** of Departments of Insurance?
* License and monitor insurers agents brokers * Ensure solvency * Set licensing standards * Review market rates and policies * Respond to customer complaints * Investigate fraud
59
What does '**solvency**' mean in the insurance context?
The ability of an insurer to **meet financial obligations** and pay claims.
60
What is the **NAIC**?
* The National Association of Insurance Commissioners * A standard-setting organization that coordinates multi-state regulation
61
What is the significance of the **McCarran-Ferguson Act** of 1945?
It affirmed that **insurance regulation** should be **managed by states** not the federal government.
62
How do Departments of Insurance **intersect with privacy**?
They **enforce privacy and data protection standards** through audits and compliance requirements tied to licensing.
63
What are NAIC '**model laws**'?
**Standardized recommended legal frameworks** designed to guide states in regulating insurance consistently.
64
What is the purpose of the **Data Security Model Law** (#668)?
To establish **cybersecurity** and **data protection standards** for insurers agents and other licensees.
65
What must insurers **implement** under the Data Security Model Law (#668)?
Information security programs risk assessments and third-party risk management.
66
What must licensees do in case of a **cybersecurity incident**?
* Investigate the incident * Notify the state Insurance Commissioner within 72 hours * Notify affected consumers
67
What is **fiduciary duty**?
A legal and ethical obligation requiring one party to **act in the highest good faith** and loyalty **for the benefit of another party** who has placed trust and reliance in them.
68
Who is the **fiduciary** and who is the **beneficiary**?
The fiduciary is the trusted party responsible for **acting in the best interest** of the beneficiary who relies on them. ## Footnote Examples: lawyers, trustees, financial advisors, and corporate directors
69
What is the **duty of loyalty** in fiduciary duty?
The fiduciary must place the **beneficiary's interests above their own** and **avoid conflicts of interest**.
70
What is the **duty of care** in fiduciary duty?
The fiduciary must act **prudently**, **competently** and **diligently** in managing the beneficiary’s interests.
71
What is the **duty of good faith** in fiduciary duty?
The fiduciary must **act honestly** and must **not mislead or deceive** the beneficiary.
72
How does fiduciary duty **apply to privacy**?
It raises the question of whether organizations should **owe fiduciary duties to consumers** regarding personal data use and protection.
73
What **conflict of interest** exists in data privacy under the current U.S. model?
Organizations seek to **monetize personal data** which conflicts with acting in the best interest of consumers.
74
What is the **FADP**?
The Revised Swiss Federal Act on Data Protection ## Footnote Replaced the 1992 version; aligns Switzerland with the EU GDPR.
75
What is the **purpose** of revising the Swiss Federal Act on Data Protection?
* Modernize Swiss privacy law * Align Switzerland with the EU GDPR to maintain adequacy for cross-border data transfers
76
What are the **penalties** for non-compliance under the FADP?
Fines up to **CHF 250,000**.
77
What **unique types** of **sensitive data** are recognized under the FADP?
* The intimate sphere of the data subject * Social security data
78
How does the **FADP** address **extraterritoriality**?
It applies when data processing **has an effect in Switzerland** even if the activity originates abroad.
79
What mechanisms are available for **third-country data transfers** under the **FADP**?
* Swiss-U.S. Data Privacy Framework * Standard contractual clauses * Binding corporate rules
80
What is the **Swiss-U.S. Data Privacy Framework**?
A mechanism allowing compliant U.S. organizations to **receive personal data from Switzerland** in accordance with Swiss privacy standards.
81
What is a **data leak**?
An accidental **exposure of data**. ## Footnote Often caused by poor security handling or misconfigurations and typically without malicious intent.
82
What are **common causes** of data leaks?
* Human error * Improperly configured access controls * Vulnerabilities in third-party systems
83
What are some **key prevention measures** for data leaks and breaches?
* Workforce training * Data loss prevention tools * Robust security policies * Continuous monitoring
84
What role do **data loss prevention tools** play in preventing leaks?
They detect and block **unauthorized transmission** or **storage** of sensitive information.
CIPP-US
flashcards
Decks in class (12)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions