Privacy CIPP- G
FIPP - answer Fair Information Practice Principles
FIPP Principles - answer1. Openness
2. Notice
3. Use
4. Correction
5. Accuracy & Security
Correction
Use
Security - answer Overlap between OECD, APEC and FIPP Privacy Principles
M-07-16 - answer What is the OMB Memorandum number that contains the currently
used definition of PII?
Privacy - answerindividual's ability to control use, collection, and dissemination of
personal information
1) Leadership
2) Privacy Risk Management & Compliance documentation
3) Information Security
4) Incident Response
5) Notice & Redress for Individuals
6) Privacy Training & Awareness
7) Accountability - answerWhat elements must be included in a federal privacy program
Use
Confidentiality
Access - answerRegarding personal information, in what ways do privacy and
information security overlap?
Names, SSN, DOBs, Employer ID numbers, E-mails, Phone numbers, residential or
business addresses, driver's license numbers, bank account information, clinical notes,
laboratory tests, prescriptions, health insurance providers - answerWhen federal, state,
or local agency data breaches occur, what types of PII may be comprised?
1) Privacy Act, 1974
2) E-Government Act, 2002 - answerTwo Key U.S. Privacy Laws
Privacy Act, 1974 Policy Objecitves - answer1. Restrict Disclosure
2. Grant access
,3. Grant amendment
4. Establish a code of Fair information practices
- Compile only what is relevant/necessary
- Provide notice of new systems of records
Agency - answerany exec dept, military dept, govt corp, govt controlled corp, or other
establishment in exec branch of fed govt (ie. exec office, regulatory agency)
Individual - answercitizen of US, or alien lawfully admitted for permanent residence
record - answerany item, collection or grouping of information that is maintained by an
agency about an individual that contains his name, identifying number, symbol or other
identifying particular assigned to the individual (ie, finger or voice print, photograph)
routine use - answeruse of a record for a purpose which is compatible with the purpose
for which the record was created in the first place
system of records (SOR) - answergroup of any records under control of any agency
from which information is retrieved by:
1) name of individual
2) or some identifying number (ie. SSN), symbol (ie. seal), or other identifying particular
assigned to individual
Agency Requirements for SOR (Privacy Act) - answer1. Collection
2. Notice
3. Record Standards
4. Access and Amendments
5. Maintenance
6. Contractors
7. Reporting
8. Data Integrity Boards
9. Safeguards
10. SSN
System of Records Notice (SORN) - answerdescription of system of records an agency
maintains
published in Federal Register
SORN Requirments (Privacy Act) - answer1. Name and location
2. Categories of Individuals
3. categories of records
4. each routine use of records
5. policies and practices
6. title, address of responsible official
,No Disclosure without Consent Rule (Privacy Act)- Most used Exceptions - answer1.
Performance of regular duties of an agency employee
2. Routine uses as specified in the applicable SORN
3. Law Enforcement
5. Court Order
12 Exceptions to No Disclosure without Consent Rule (Privacy Act) - answer1.
Performance of regular duties of an agency
2. FOIA disclosures
3. Routine uses
4. Census Bureau
5. Statistical research
6. Data held by the National Archives
7. Law enforcement
8. Compelling health/safety circumstances
9. Congressional committee (w/ jurisdiction)
10. GAO duties
11. Court order
12. Consumer reporting agencies
Exemptions to Specific Provisions - answerexist to not tip off individuals under
investigation:
SOR maintained by
1. CIA
2. Agencies that perform activities to enforce criminal laws
Civil Remedies and Criminal Penalties - answerPrivacy Act Enforcement
Civil Remedies - answer1. agency refused to amend individual record upon request, or
refused to provide individual access to his records, individual can sue in court
2. court can award individual attorney fees
3. actual damages suffered by individual, no less than $1000, plus costs and
reasonable attorney fees
Criminal penalites - answerknowingly and willfully discloses PII, maintains a SOR
without disclosing its existence,
1. misdemeanor
2.fined maximum of $5000
Office of Management and Budget (Privacy Act) - answersupervise agency agency
implementation of Privacy Act provisions
Director-
1. develop/prescribe guidelines/regulation (directive) to agencies,
2. assistance/oversight of implentation of Privacy by agencies
3. renew new and altered system of records and matching program reports
, *Additional legal guidance DOJ Office of Privacy and Civil Liberties- legally analyze and
refer to court decisions regarding certain provisions of Privacy Act
Computer Matching &Privacy Protection Act, 1988 - answerContains provisions that
require agencies that match data among agency ystems granting financial benefits to
publicly disclose that matching and explain its scope
Computer Matching Act, 1988 - answer1. Written agreement bw agencies has purpose,
justification, legal authority and description of records to match
2. notice: of matching program at time of creation
3. disclose: agency cannot disclose records if it believes matching agreement is not
being followed by recipient
4. reports on matching programs to OMB annually
Computer Matching Example - answerDate: May 2008
Organizations: HUD, VA
Notice: VA provides HUD with data on individuals who have defaulted on their VA-
gauranteed home loans
Data: SSN, EIN, case number, Fed Agency identifying code, record type
in response to concern of govt's misuse of citizen data in computerized databases.
focus is to restrict how agencies collect, maintain, use and disclose PII - answerWhy
was the Privacy Act of 1974 created?
a group of any record under the control of any agency from which information is
retrieved by name of individual or some identifying number, symbol or other identifying
particular assigned to individual (ie. voice or finger print, picture) - answerWhat is a
SOR?
1. Name/location
2. Categories of individuals whose records are maintained
3. Categories of records maintained
4. Each routine use of records, including categories of users and the purpose of such
use
5. Policies and practices regarding storage, retrievability, access controls, retention and
disposal of the records
6. Title and address of official responsible for SOR - answerWhat are required elements
of a SORN?
To allow agencies to not require individual's consent to use/disclose PII - answerWhat is
the purpose of the 12 exceptions tot he Privacy Act of 1974?
1. refusal to amend record
2. refusal request for access to record
3. fails to comply with data safeguards in or any other rights established under PA -
answerFor what reasons can an individual file a lawsuit under the Privacy Act?
FIPP - answer Fair Information Practice Principles
FIPP Principles - answer1. Openness
2. Notice
3. Use
4. Correction
5. Accuracy & Security
Correction
Use
Security - answer Overlap between OECD, APEC and FIPP Privacy Principles
M-07-16 - answer What is the OMB Memorandum number that contains the currently
used definition of PII?
Privacy - answerindividual's ability to control use, collection, and dissemination of
personal information
1) Leadership
2) Privacy Risk Management & Compliance documentation
3) Information Security
4) Incident Response
5) Notice & Redress for Individuals
6) Privacy Training & Awareness
7) Accountability - answerWhat elements must be included in a federal privacy program
Use
Confidentiality
Access - answerRegarding personal information, in what ways do privacy and
information security overlap?
Names, SSN, DOBs, Employer ID numbers, E-mails, Phone numbers, residential or
business addresses, driver's license numbers, bank account information, clinical notes,
laboratory tests, prescriptions, health insurance providers - answerWhen federal, state,
or local agency data breaches occur, what types of PII may be comprised?
1) Privacy Act, 1974
2) E-Government Act, 2002 - answerTwo Key U.S. Privacy Laws
Privacy Act, 1974 Policy Objecitves - answer1. Restrict Disclosure
2. Grant access
,3. Grant amendment
4. Establish a code of Fair information practices
- Compile only what is relevant/necessary
- Provide notice of new systems of records
Agency - answerany exec dept, military dept, govt corp, govt controlled corp, or other
establishment in exec branch of fed govt (ie. exec office, regulatory agency)
Individual - answercitizen of US, or alien lawfully admitted for permanent residence
record - answerany item, collection or grouping of information that is maintained by an
agency about an individual that contains his name, identifying number, symbol or other
identifying particular assigned to the individual (ie, finger or voice print, photograph)
routine use - answeruse of a record for a purpose which is compatible with the purpose
for which the record was created in the first place
system of records (SOR) - answergroup of any records under control of any agency
from which information is retrieved by:
1) name of individual
2) or some identifying number (ie. SSN), symbol (ie. seal), or other identifying particular
assigned to individual
Agency Requirements for SOR (Privacy Act) - answer1. Collection
2. Notice
3. Record Standards
4. Access and Amendments
5. Maintenance
6. Contractors
7. Reporting
8. Data Integrity Boards
9. Safeguards
10. SSN
System of Records Notice (SORN) - answerdescription of system of records an agency
maintains
published in Federal Register
SORN Requirments (Privacy Act) - answer1. Name and location
2. Categories of Individuals
3. categories of records
4. each routine use of records
5. policies and practices
6. title, address of responsible official
,No Disclosure without Consent Rule (Privacy Act)- Most used Exceptions - answer1.
Performance of regular duties of an agency employee
2. Routine uses as specified in the applicable SORN
3. Law Enforcement
5. Court Order
12 Exceptions to No Disclosure without Consent Rule (Privacy Act) - answer1.
Performance of regular duties of an agency
2. FOIA disclosures
3. Routine uses
4. Census Bureau
5. Statistical research
6. Data held by the National Archives
7. Law enforcement
8. Compelling health/safety circumstances
9. Congressional committee (w/ jurisdiction)
10. GAO duties
11. Court order
12. Consumer reporting agencies
Exemptions to Specific Provisions - answerexist to not tip off individuals under
investigation:
SOR maintained by
1. CIA
2. Agencies that perform activities to enforce criminal laws
Civil Remedies and Criminal Penalties - answerPrivacy Act Enforcement
Civil Remedies - answer1. agency refused to amend individual record upon request, or
refused to provide individual access to his records, individual can sue in court
2. court can award individual attorney fees
3. actual damages suffered by individual, no less than $1000, plus costs and
reasonable attorney fees
Criminal penalites - answerknowingly and willfully discloses PII, maintains a SOR
without disclosing its existence,
1. misdemeanor
2.fined maximum of $5000
Office of Management and Budget (Privacy Act) - answersupervise agency agency
implementation of Privacy Act provisions
Director-
1. develop/prescribe guidelines/regulation (directive) to agencies,
2. assistance/oversight of implentation of Privacy by agencies
3. renew new and altered system of records and matching program reports
, *Additional legal guidance DOJ Office of Privacy and Civil Liberties- legally analyze and
refer to court decisions regarding certain provisions of Privacy Act
Computer Matching &Privacy Protection Act, 1988 - answerContains provisions that
require agencies that match data among agency ystems granting financial benefits to
publicly disclose that matching and explain its scope
Computer Matching Act, 1988 - answer1. Written agreement bw agencies has purpose,
justification, legal authority and description of records to match
2. notice: of matching program at time of creation
3. disclose: agency cannot disclose records if it believes matching agreement is not
being followed by recipient
4. reports on matching programs to OMB annually
Computer Matching Example - answerDate: May 2008
Organizations: HUD, VA
Notice: VA provides HUD with data on individuals who have defaulted on their VA-
gauranteed home loans
Data: SSN, EIN, case number, Fed Agency identifying code, record type
in response to concern of govt's misuse of citizen data in computerized databases.
focus is to restrict how agencies collect, maintain, use and disclose PII - answerWhy
was the Privacy Act of 1974 created?
a group of any record under the control of any agency from which information is
retrieved by name of individual or some identifying number, symbol or other identifying
particular assigned to individual (ie. voice or finger print, picture) - answerWhat is a
SOR?
1. Name/location
2. Categories of individuals whose records are maintained
3. Categories of records maintained
4. Each routine use of records, including categories of users and the purpose of such
use
5. Policies and practices regarding storage, retrievability, access controls, retention and
disposal of the records
6. Title and address of official responsible for SOR - answerWhat are required elements
of a SORN?
To allow agencies to not require individual's consent to use/disclose PII - answerWhat is
the purpose of the 12 exceptions tot he Privacy Act of 1974?
1. refusal to amend record
2. refusal request for access to record
3. fails to comply with data safeguards in or any other rights established under PA -
answerFor what reasons can an individual file a lawsuit under the Privacy Act?
