CIPM IAPP-Final Practice Questions

Acceptable Use Policy a policy that a user must agree to follow in order to be provided access to a network or to the internet. It also stipulates rules and constraints for people within and outside of the organization who access the network or internet connection. Business Continuity Management What integrates the disciplines of Emergency Response, Crisis Management, Disaster Recovery (technology continuity) and Business Continuity (organizational/operational relocation)? 5 Sanity-Saving Tips for Arguing on the Internet Control Objectives for Information and Related Technology This helps organisations meet business challenges in regulatory compliance, risk management and aligning IT strategy with organisational goals. European Telecommunications Standards Institute This nonprofit enterprise whose mission is to produce the telecommunications standards that will be used throughout Europe. Standards developed by this organization may be adopted by the European Commission as the technical base for directives or regulations. Fair Information Practices (FIPs) (1) The Collection Limitation Principle. (2) The Data Quality Principle. (3) The Purpose Specification Principle. (4) The Use Limitation Principle. (5) The Security Safeguards Principle. (6) The Openness Principle. (7) The Individual Participation Principle. (8) The Accountability Principle. GDPR (General Data Protection Regulation) replaced the Data Protection Directive in 2018. The aim of the this is to provide one set of data protection rules for all EU member states and the European Economic Area (EEA). The document comprises 173 recitals and 99 articles. HIPAA (Health Insurance Portability and Accountability Act) A U.S. law passed to create national standards for electronic healthcare transactions, among other purposes. This law required the U.S. Department of Health and Human Services to promulgate regulations to protect the privacy and security of personal health information. The basic rule is that patients have to opt in before their information can be shared with other organizations—although there are important exceptions such as for treatment, payment and healthcare operations. Hybrid Governance Model This privacy governance model allows for a combination of centralized and local governance. Typically seen when a large organization assigns a main individual responsibility for privacy-related affairs, and the local entities then fulfill and support the policies and directives from the central governing body. International Electrotechnical Commission (IEC) The predominant organization for developing and publishing international standards for technologies related to electrical and electronic devices and processes International Organization for Standardization (ISO) A non-governmental global organization whose principal activity is the development of technical standards through consensus. ISACA (Information Systems Audit and Control Association) a set of guidelines/supporting tools for IT governance accepted worldwide Localized Governance Model this governance model involves the delegation of decision-making authority down to the lower levels in an organization, away from and lower than a central authority. There are fewer tiers in the organizational structure, wider span of control and bottom-to-top flow of decision-making and ideas. Decentralized Governance Model this governance model involves the delegation of decision-making authority down to the lower levels in an organization, away from and lower than a central authority. There are fewer tiers in the organizational structure, wider span of control and bottom-to-top flow of decision-making and ideas National Institute of Standards and Technology An agency within the Department of Commerce. This agency has the lead responsibility for the development and issuance of security standards and guidelines for the federal government, contractors, and the United States critical information infrastructure. This agency has published a series of publications in support of its risk management framework (RMF). The RMF is a multi-tiered and structured methodology for creating a unified information security framework for the federal government in order to meet the vast array of requirements set forth in FISMA. Organization for Economic Cooperation and Development An international organization that promotes policies designed to achieve the highest sustainable economic growth, employment and a rising standard of living in both member and non-member countries, while contributing to the world economy. SOC 1 SOC 2 Accountability The implementation of appropriate technical and organisational measures to ensure and be able to demonstrate that the handling of personal data is performed in accordance with relevant law, an idea codified in the EU General Data Protection Regulation and other frameworks, including APEC's Cross Border Privacy Rules. Traditionally, it has been a fair information practices principle, that due diligence and reasonable steps will be undertaken to ensure that personal information will be protected and handled consistently with relevant law and other fair use principles. Active Scanning Tools DLP network, storage, scans and privacy tools can be used to identify security and privacy risks to personal information. They can also be used to monitor for compliance with internal policies and procedures, and block e-mail or file transfers based on the data category and definitions. American Institute of Certified Public Accountants A U.S. professional organization of certified public accountants and co-creator of the WebTrust seal program. Anonymization The process in which individually identifiable data is altered in such a way that it no longer can be related back to a given individual. APEC Privacy Principles A set of non-binding principles adopted by the Asia-Pacific Economic Cooperative (APEC) that mirror the OECD Fair Information Privacy Practices. Though based on OECD Guidelines, they seek to promote electronic commerce throughout the Asia-Pacific region by balancing information privacy with business needs. Assess One of the four phases of the privacy operational life cycle; provides the steps, checklists and processes necessary to assess any gaps in a privacy program as compared to industry best practices, corporate privacy policies, applicable privacy laws, and objective-based privacy program frameworks. Audit Life Cycle High-level, five-phase audit approach. The steps include: Audit Planning; Audit Preparation; Conducting the Audit; Reporting; and Follow-up. Behavioral Advertising Advertising that is targeted at individuals based on the observation of their behaviour over time. Most often done via automated processing of personal data, or profiling, the General Data Protection Regulation requires that data subjects be able to opt-out of any automated processing, to be informed of the logic involved in any automatic personal data processing and, at least when based on profiling, be informed of the consequences of such processing. If cookies are used to store or access information for the purposes of behavioral advertising, the ePrivacy Directive requires that data subjects provide consent for the placement of such cookies, after having been provided with clear and comprehensive information. Acronym(s): OBAAssociated term(s): Online Behavioral Advertising, Behavioral Targeting, Contextual Advertising, Demographic Advertising, Premium Advertising, Psychographic Advertising, Remnant Advertising Binding Corporate Rules These are an appropriate safeguard allowed by the General Data Protection Regulation to facilitate cross-border transfers of personal data between the various entities of a corporate group worldwide. They do so by ensuring that the same high level of protection of personal data is complied with by all members of the organizational group by means of a single set of binding and enforceable rules. These compel organizations to be able to demonstrate their compliance with all aspects of applicable data protection legislation and are approved by a member state data protection authority. Bureau of Competition This agency enforces the nation's antitrust laws, which form the foundation of our free market economy. The antitrust laws promote the interests of consumers; they support unfettered markets and result in lower prices and more choices. Bureau of Consumer Protection This agency stops unfair, deceptive and fraudulent business practices by collecting complaints and conducting investigations, suing companies and people that break the law, developing rules to maintain a fair marketplace, and educating consumers and businesses about their rights and responsibilities. Bureau of Economics This agency helps the FTC evaluate the economic impact of its actions by providing economic analysis for competition and consumer protection investigations and rule makings, and analyzing the economic impact of government regulations on businesses and consumers. Business case The starting point for assessing the needs of the privacy organization, it defines the individual program needs and the ways to meet specific business goals, such as compliance with privacy laws or regulations, industry frameworks, customer requirements and other considerations. Business Continuity and Disaster Recovery Plan A risk mitigation plan designed to prepare an organization for crises and to ensure critical business functions continue. The focus is to recover from a disaster when disruptions of any size are encountered. Business Continuity Plan This is typically drafted and maintained by key stakeholders, spelling out departmental responsibilities and actions teams must take before, during and after an event in order to help operations run smoothly. Situations covered in a BCP often include fire, flood, natural disasters (tornadoes and hurricanes), and terrorist attack. Canadian Institute of Chartered Accountants This organziation in partnership with the provincial and territorial institutes, is responsible for the functions that are critical to the success of the Canadian CA profession. Pursuant to the 2006 Protocol, is entrusted with the responsibility for providing strategic leadership, co-ordination of common critical functions of strategic planning, protection of the public and ethics, education and qualification, standard setting and communications. Centralized governance Privacy governance model that leaves one team or person responsible for privacy-related affairs; all other persons or organizations will flow through this point. Children's Online Privacy Protection Act (COPPA) of 1998 A U.S. federal law that applies to the operators of commercial websites and online services that are directed to children under the age of 13. Choice In the context of consent, this refers to the idea that consent must be freely given and that data subjects must have a genuine choice as to whether to provide personal data or not. If there is no true _____ it is unlikely the consent will be deemed valid under the General Data Protection Regulation. CIA Triad Three common information security principles from the 1960s: Confidentiality, integrity, availability. Collection Limitation A fair information practices principle, it is the principle stating there should be limits to the collection of personal data, that any such data should be obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject. Consent This privacy requirement is one of the fair information practices. Individuals must be able to prevent the collection of their personal data, unless the disclosure is required by law. If an individual has choice about the use or disclosure of his or her information, consent is the individual's way of giving permission for the use or disclosure. Consumer Reporting Agency Any person or entity that complies or evaluates personal information for the purpose of furnishing consumer reports to third parties for a fee. Current baseline "As-is" data privacy requirements; the current environment and any protections, policies, and procedures currently deployed. Cyber liability insurance Relatively new form of insurance protection that fills gaps typically not covered by General Commercial Liability plans. This insurance may cover many breach-related expenses, including forensic investigations, outside counsel fees, crisis management services, public relations experts, breach notification, and call center costs. Data Breach The unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a data collector. Data Controller The natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by EU or member state law, the controller or the specific criteria for its nomination may be provided for by EU or member state law. Data Inventory Also known as a record of authority, identifies personal data as it moves across various systems and thus how data is shared and organized, and its location. That data is then categorized by subject area, which identifies inconsistent data versions, enabling identification and mitigation of data disparities. Data Life Cycle Management Also known as Information Life Cycle Management (ILM) or data governance, this is a policy-based approach to managing the flow of information through a life cycle from creation to final disposition. This provides a holistic approach to the processes, roles, controls and measures necessary to organize and maintain data, and has 11 elements: Enterprise objectives; minimalism; simplicity of procedure and effective training; adequacy of infrastructure; information security; authenticity and accuracy of one's own records; retrievability; distribution controls; auditability; consistency of policies; and enforcement. Data Minimization Principle The idea that one should only collect and retain that personal data which is necessary. Data Protection Authority Independent public authorities that supervise the application of data protection laws in the EU. Data Protection Impact Assessment The process by which companies can systematically assess and identify the privacy and data protection impacts of any products they offer and services they provide. It enables them to identify the impact and take the appropriate actions to prevent or, at the very least, minimise the risk of those impacts. Data Quality A fair information practices principle, it is the principle that personal data should be relevant to the purposes for which it is to be used, and, to the extent necessary for those purposes, should be accurate, complete and kept up-to-date. It is judged by four criteria: Does it meet the business needs?; Is it accurate?; Is it complete?, and is it recent? Data is of an appropriate quality if these criteria are satisfied for a particular application. Decentralized Governance Also known as "local governance," this governance model involves the delegation of decision-making authority down to the lower levels in an organization, away from and lower than a central authority. There are fewer tiers in the organizational structure, wider span of control and bottom-to-top flow of decision-making and ideas. Direct Marketing When the seller directly contacts an individual, in contrast to marketing through mass media such as television or radio. Do Not Track A proposed regulatory policy, similar to the existing Do-Not-Call Registry in the United States, which would allow consumers to opt out of web-usage tracking. Electronic Communications Privacy Act of 1986 This law as amended, protects wire, oral and electronic communications while those communications are being made, are in transit, and when they are stored on computers. The act applies to e-mail, telephone conversations and data stored electronically. EU Data Protection Directive This was replaced by the General Data Protection Regulation in 2018. The first EU-wide legislation that protected individuals' privacy and personal data use. Five-Step Metric Life Cycle Tools that facilitate decision-making and accountability through collection, analysis, and reporting of data. They must be measurable, meaningful, clearly defined (with boundaries), indicate progress, and answer a specific question to be valuable and practical.