CIPP/US flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Sectoral privacy model

U.S. approach that relies on separate federal statutes for specific industries or data types rather than one comprehensive law, supplemented by FTC and state regulation.

FTC Act Section 5

Federal statute prohibiting unfair or deceptive acts or practices in commerce; basis for FTC privacy enforcement, including deceptive privacy policies and unreasonable data security.

Prosser privacy torts

Four common-law claims: intrusion upon seclusion, public disclosure of private facts, false light, and appropriation; each requires different elements and protects different interests.

OECD Fair Information Principles

Collection limitation, data quality, purpose specification, use limitation, security, openness, individual participation, and accountability; foundational principles reflected in many privacy laws.

EU-U.S. Data Privacy Framework

2023 transfer mechanism allowing certified U.S. companies to receive EU personal data; it replaced the invalidated Safe Harbor and Privacy Shield frameworks.

FTC unfairness standard

Practice causes or is likely to cause substantial injury not reasonably avoidable by consumers and not outweighed by benefits to consumers or competition.

FCRA permissible purpose

Consumer reporting agencies may furnish consumer reports only for statutorily allowed uses such as credit, employment, insurance, or legitimate business transactions with the consumer.

GLBA opt-out right

Financial institutions must let customers opt out before sharing nonpublic personal information with nonaffiliated third parties, subject to exceptions, and must provide privacy notices.

HIPAA minimum necessary

Covered entities and business associates must limit uses and disclosures of protected health information to the minimum needed for the intended purpose, with exceptions.

COPPA parental consent

Operators collecting personal information from children under 13 must obtain verifiable parental consent before collection, use, or disclosure, with limited exceptions.

CAN-SPAM opt-out

Commercial email must include a functioning opt-out mechanism, and senders must honor opt-out requests within 10 business days; header and subject information must be accurate.

TCPA prior express consent

Autodialed or prerecorded marketing calls and texts to wireless numbers generally require prior express written consent; consent must be clear and documented.

Data minimization principle

Organizations should collect and retain only personal data that is reasonably necessary for a specified purpose and should delete it when no longer needed.

Third-party doctrine

Government access to information voluntarily shared with a third party, such as bank records or phone numbers dialed, generally does not constitute a Fourth Amendment search.

Carpenter cell-site ruling

Supreme Court held that acquiring historical cell-site location records is a Fourth Amendment search generally requiring a warrant, a limited exception to the third-party doctrine.

Stored Communications Act

Federal law governing government and private access to stored electronic communications; uses subpoenas, court orders, and warrants depending on content and age.

Wiretap Act consent exception

Interception is lawful if one party to the communication consents, unless interception is for criminal or tortious purpose; federal and state rules vary.

National Security Letter

FBI administrative subpoena for subscriber, billing, and transactional records in national security investigations; includes nondisclosure requirements subject to judicial review.

CLOUD Act

2018 law requiring U.S. providers to comply with warrants for electronic data stored abroad and authorizing executive agreements for foreign data requests.

FISA Section 702

Authorizes targeted surveillance of non-U.S. persons reasonably believed abroad; requires certifications, minimization, and oversight, but has drawn privacy challenges.

Business-extension exception

ECPA exception allowing employers to monitor communications in the ordinary course of business using equipment provided for business use, subject to limits.

NLRA Section 7

Protects employees' rights to engage in concerted activity; employer surveillance and broad social-media policies can violate the Act by chilling protected discussions.

FCRA employment reports

Employers using third-party background reports must disclose and obtain authorization, provide pre-adverse action notice, and give adverse action notice with summary of rights.

Social media password laws

State statutes prohibiting employers from requiring employees or applicants to disclose social-media credentials, with exceptions for workplace devices and investigations.

Connecticut monitoring notice

Connecticut law requires employers who electronically monitor employees to give prior written notice, including the types of monitoring and methods used.

ADA medical confidentiality

Employers must keep employee medical information confidential and separate from personnel files, with limited exceptions for supervisors, safety, and legal compliance.

CCPA private right of action

California law provides a limited private right to sue for data breaches involving unencrypted personal information, subject to notice and cure and statutory damages.

CPRA sensitive personal information

California category including government IDs, financial accounts, precise geolocation, race, health, sexual orientation, and communications; consumers may limit use and disclosure.

Data protection assessment

Required evaluation of high-risk processing under several state laws, documenting purpose, necessity, risks, safeguards, and mitigation before processing begins.

State AG enforcement

Most comprehensive state privacy laws are enforced by attorneys general, not private plaintiffs, with civil penalties and cure periods that vary by state.

Illinois BIPA consent

Requires written notice and consent before collecting biometric identifiers, plus a retention schedule and destruction when purpose ends; private right of action.

Breach notification laws

All states and D.C. require notice to affected individuals after a data breach involving personal information; timing, content, and regulator notice thresholds vary.