CIPP/E
Study online at https://quizlet.com/_butnf8
1. accontability The implementation of appropriate technical and organisational measures to
ensure and be able to
demonstrate that the handling of personal data is performed in accordance with
relevant law, an idea
codified in the EU General Data Protection Regulation and other frameworks,
including APEC's Cross
Border Privacy Rules. Traditionally, accountability has been a fair information
practices principle, that
due diligence and reasonable steps will be undertaken to ensure that personal
information will be
protected and handled consistently with relevant law and other fair use principles.
2. Accuracy Organizations must take every reasonable step to ensure the data processed is
accurate and, where
necessary, kept up to date. Reasonable measures should be understood as
implementing processes to
prevent inaccuracies during the data collection process as well as during the
ongoing data processing in
relation to the specific use for which the data is processed. The organization must
consider the type of
data and the specific purposes to maintain the accuracy of personal data in
relation to the purpose.
Accuracy also embodies the responsibility to respond to data subject requests to
correct records that
contain incomplete information or misinformation.
3. Adequate Level A transfer of personal data from the European Union to a third country or an
of Protection international organisation
may take place where the European Commission has decided that the third
country, a territory or one or
more specified sectors within that third country, or the international organisation
in question, ensures
, CIPP/E
Study online at https://quizlet.com/_butnf8
an adequate level of protection by taking into account the following elements: (a)
the rule of law, respect
for human rights and fundamental freedoms, both general and sectoral legisla-
tion, data protection rules,
professional rules and security measures, effective and enforceable data subject
rights and effective
administrative and judicial redress for the data subjects whose personal data is
being transferred; (b) the
existence and effective functioning of independent supervisory authorities with
responsibility for
ensuring and enforcing compliance with the data protection rules; (c) the inter-
national commitments the
third country or international organisation concerned has entered into in relation
to the protection of
personal data.
4. Annual Reports The requirement under the General Data Protection Regulation that the European
Data Protection Board
and each supervisory authority periodically report on their activities. The supervi-
sory authority report
should include infringements and the activities that the authority conducted under
their Article 58(2)
powers. The EDPB report should include guidelines, recommendations, best
practices and binding
decisions. Additionally, the report should include the protection of natural persons
with regard to
processing in the EU and, where relevant, in third countries and international
organisations. The report
shall be made public and be transmitted to the European Parliament, to the
Council and to the
Commission.
, CIPP/E
Study online at https://quizlet.com/_butnf8
5. Anonymous In- In contrast to personal data, anonymous information or data is not related to an
formation identified or an
identifiable natural person and cannot be combined with other information to
re-identify individuals. It
has been rendered unidentifiable and, as such, is not protected by the GDPR.
6. Anti-discrimina- are indications of special classes of personal data. If there exists law protecting
tion laws against discrimination based on a class or status, it is likely personal information
relating to that class or
status is subject to more stringent data protection regulation, under the GDPR or
otherwise.
7. Appropriate GDPR refers to appropriate safeguards in a number of contexts,
Safeguards including the transfer of personal data to third countries outside the European
Union, the processing of
special categories of data, and the processing of personal data in a law enforce-
ment context. This
generally refers to the application of the general data protection principles, in
particular purpose
limitation, data minimisation, limited storage periods, data quality, data protec-
tion by design and by
default, legal basis for processing, processing of special categories of personal
data, measures to ensure
data security, and the requirements in respect of onward transfers to bodies not
bound by the binding
corporate rules. This may also refer to the use of encryption or pseudonymization,
standard data
protection clauses adopted by the Commission, contractual clauses authorized by
a supervisory
authority, or certification schemes or codes of conduct authorized by the Commis-
sion or a supervisory
authority. Those safeguards should ensure compliance with data protection re-
, CIPP/E
Study online at https://quizlet.com/_butnf8
quirements and the rights
of the data subjects appropriate to processing within the European Union.
8. Appropriate GDPR requires a risk-based approach to data protection, whereby
Technical and organizations take into account the nature, scope, context and purposes of pro-
Organizational cessing, as well as the
Measures risks of varying likelihood and severity to the rights and freedoms of natural
persons, and institute
policies, controls and certain technologies to mitigate those risks. These "appro-
priate technical and
organisational measures" might help meet the obligation to keep personal data
secure, including
technical safeguards against accidents and negligence or deliberate and malev-
olent actions, or involve
the implementation of data protection policies. These measures should be
demonstrable on demand to
data protection authorities and reviewed regularly.
9. Article 29 Work- (WP29) was a European Union organization that functioned as an
ing Party independent advisory body on data protection and privacy and consisted of the
collected data protection
authorities of the member states. It was replaced by the similarly constituted
European Data Protection
Board (EDPB) on May 25, 2018, when the General Data Protection Regulation
(GDPR) went into effect.
10. Authentication The process by which an entity (such as a person or computer system) determines
whether another
entity is who it claims to be.
11. Automated Pro- A processing operation that is performed without any human intervention. "Pro-
cessing filing" is defined in the
General Data Protection Regulation, for example, as the automated processing of
Study online at https://quizlet.com/_butnf8
1. accontability The implementation of appropriate technical and organisational measures to
ensure and be able to
demonstrate that the handling of personal data is performed in accordance with
relevant law, an idea
codified in the EU General Data Protection Regulation and other frameworks,
including APEC's Cross
Border Privacy Rules. Traditionally, accountability has been a fair information
practices principle, that
due diligence and reasonable steps will be undertaken to ensure that personal
information will be
protected and handled consistently with relevant law and other fair use principles.
2. Accuracy Organizations must take every reasonable step to ensure the data processed is
accurate and, where
necessary, kept up to date. Reasonable measures should be understood as
implementing processes to
prevent inaccuracies during the data collection process as well as during the
ongoing data processing in
relation to the specific use for which the data is processed. The organization must
consider the type of
data and the specific purposes to maintain the accuracy of personal data in
relation to the purpose.
Accuracy also embodies the responsibility to respond to data subject requests to
correct records that
contain incomplete information or misinformation.
3. Adequate Level A transfer of personal data from the European Union to a third country or an
of Protection international organisation
may take place where the European Commission has decided that the third
country, a territory or one or
more specified sectors within that third country, or the international organisation
in question, ensures
, CIPP/E
Study online at https://quizlet.com/_butnf8
an adequate level of protection by taking into account the following elements: (a)
the rule of law, respect
for human rights and fundamental freedoms, both general and sectoral legisla-
tion, data protection rules,
professional rules and security measures, effective and enforceable data subject
rights and effective
administrative and judicial redress for the data subjects whose personal data is
being transferred; (b) the
existence and effective functioning of independent supervisory authorities with
responsibility for
ensuring and enforcing compliance with the data protection rules; (c) the inter-
national commitments the
third country or international organisation concerned has entered into in relation
to the protection of
personal data.
4. Annual Reports The requirement under the General Data Protection Regulation that the European
Data Protection Board
and each supervisory authority periodically report on their activities. The supervi-
sory authority report
should include infringements and the activities that the authority conducted under
their Article 58(2)
powers. The EDPB report should include guidelines, recommendations, best
practices and binding
decisions. Additionally, the report should include the protection of natural persons
with regard to
processing in the EU and, where relevant, in third countries and international
organisations. The report
shall be made public and be transmitted to the European Parliament, to the
Council and to the
Commission.
, CIPP/E
Study online at https://quizlet.com/_butnf8
5. Anonymous In- In contrast to personal data, anonymous information or data is not related to an
formation identified or an
identifiable natural person and cannot be combined with other information to
re-identify individuals. It
has been rendered unidentifiable and, as such, is not protected by the GDPR.
6. Anti-discrimina- are indications of special classes of personal data. If there exists law protecting
tion laws against discrimination based on a class or status, it is likely personal information
relating to that class or
status is subject to more stringent data protection regulation, under the GDPR or
otherwise.
7. Appropriate GDPR refers to appropriate safeguards in a number of contexts,
Safeguards including the transfer of personal data to third countries outside the European
Union, the processing of
special categories of data, and the processing of personal data in a law enforce-
ment context. This
generally refers to the application of the general data protection principles, in
particular purpose
limitation, data minimisation, limited storage periods, data quality, data protec-
tion by design and by
default, legal basis for processing, processing of special categories of personal
data, measures to ensure
data security, and the requirements in respect of onward transfers to bodies not
bound by the binding
corporate rules. This may also refer to the use of encryption or pseudonymization,
standard data
protection clauses adopted by the Commission, contractual clauses authorized by
a supervisory
authority, or certification schemes or codes of conduct authorized by the Commis-
sion or a supervisory
authority. Those safeguards should ensure compliance with data protection re-
, CIPP/E
Study online at https://quizlet.com/_butnf8
quirements and the rights
of the data subjects appropriate to processing within the European Union.
8. Appropriate GDPR requires a risk-based approach to data protection, whereby
Technical and organizations take into account the nature, scope, context and purposes of pro-
Organizational cessing, as well as the
Measures risks of varying likelihood and severity to the rights and freedoms of natural
persons, and institute
policies, controls and certain technologies to mitigate those risks. These "appro-
priate technical and
organisational measures" might help meet the obligation to keep personal data
secure, including
technical safeguards against accidents and negligence or deliberate and malev-
olent actions, or involve
the implementation of data protection policies. These measures should be
demonstrable on demand to
data protection authorities and reviewed regularly.
9. Article 29 Work- (WP29) was a European Union organization that functioned as an
ing Party independent advisory body on data protection and privacy and consisted of the
collected data protection
authorities of the member states. It was replaced by the similarly constituted
European Data Protection
Board (EDPB) on May 25, 2018, when the General Data Protection Regulation
(GDPR) went into effect.
10. Authentication The process by which an entity (such as a person or computer system) determines
whether another
entity is who it claims to be.
11. Automated Pro- A processing operation that is performed without any human intervention. "Pro-
cessing filing" is defined in the
General Data Protection Regulation, for example, as the automated processing of
