C CLE flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Preponderance of the evidence

The civil burden of proof meaning the claim is more likely true than not, typically expressed as greater than 50 percent probability. It is lower than the criminal beyond-a-reasonable-doubt standard.

Beyond a reasonable doubt

The criminal burden of proof requiring the factfinder to be firmly convinced of guilt, with no plausible alternative explanation leaving reasonable doubt. It is the highest standard commonly applied.

Intrusion upon seclusion

A privacy tort involving intentional intrusion, physical or electronic, into a place or conversation where the plaintiff had a reasonable expectation of privacy, in a manner highly offensive to a reasonable person.

Clickwrap agreement

A contract formed when a user clicks an accept button after being presented terms. It is generally enforceable when the user had reasonable notice and an opportunity to review before accepting.

Negligence elements

Four elements a plaintiff must prove: a duty of care owed, breach of that duty, actual and proximate causation, and resulting damages. Failure on any element defeats the claim.

Discovery rule

A doctrine delaying the start of a limitations period until the plaintiff knew or reasonably should have known of the injury. It often extends exposure in late-detected breach cases.

Minimum contacts

The due-process test for personal jurisdiction requiring a defendant to have purposeful contacts with the forum. Random or incidental contact, such as a website being accessible, is usually insufficient.

GDPR material scope

GDPR applies to processing of personal data wholly or partly by automated means, and to non-automated processing of data in filing systems, subject to household and law-enforcement exclusions.

GDPR 72-hour notification

Controllers must notify the supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in risk.

NIS2 early warning

Under the EU NIS2 Directive, significant incidents require an early warning to the CSIRT within 24 hours of awareness, followed by an incident notification within 72 hours.

HIPAA breach notification

Covered entities must notify affected individuals of a breach of unsecured protected health information without unreasonable delay and no later than 60 days after discovery.

PCI DSS status

A contractual security standard for cardholder data, enforced through acquirer and card-network agreements. It is not a statute, though some laws reference it as a benchmark.

ISO/IEC 27001 certification

Certification that an organization's information security management system conforms to the standard within a defined scope. It certifies the management system, not individual products.

SOC 2 Type II

An independent attestation report on the operating effectiveness of controls against selected trust services criteria over a period, typically six to twelve months, rather than at a single point in time.

Legal hold

A directive to preserve potentially relevant information once litigation, investigation, or regulatory action is reasonably anticipated. It suspends routine deletion and overrides retention schedules.

Controller versus processor

A controller determines the purposes and means of processing; a processor acts on the controller's behalf. Notification duties to regulators and individuals generally rest with the controller.

Incident response lifecycle

The phases of preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity. Notification decisions run in parallel with technical containment rather than after it.

GDPR breach definition

A security incident leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, personal data. It is broader than mere confidentiality loss.

Encryption safe harbor

Many breach laws exempt notification when data was encrypted and the key was not compromised, provided encryption was not rendered ineffective. The breached entity usually bears the burden.

Notification clock start

Deadlines generally begin when the entity discovers the incident, not when full scope is confirmed. Delay for investigation must still fit within without-unreasonable-delay standards.

SEC Form 8-K Item 1.05

Requires public companies to disclose material cybersecurity incidents generally within four business days of determining materiality, describing nature, scope, timing, and material impact.

Required breach notice content

Typical required elements include the nature of the incident, categories and approximate number of affected data subjects, contact details, likely consequences, and measures taken or proposed.

Processor notification duty

A processor must notify the controller without undue delay after becoming aware of a breach. The controller then decides on regulator and individual notification.

Incident report privilege

Protection from disclosure for incident analyses prepared at counsel's direction for legal advice. Routine business reports and raw third-party drafts may fall outside the privilege.

Unauthorized access offense

A core computer-crime offense criminalizing access to a system without permission or exceeding authorized scope. Authorization boundaries come from the owner's expressed or implied permission.

Budapest Convention

A Council of Europe treaty harmonizing computer-crime offenses and establishing 24/7 points of contact and mutual legal assistance for cross-border preservation and evidence collection.

Chain of custody

Documented, unbroken record of who handled evidence, when, where, and what was done at each transfer. Gaps can support challenges to authenticity and admissibility.

Forensic hash verification

Computing a cryptographic digest such as SHA-256 at acquisition and recomputing it later. Matching values support a claim that the image was not altered.

Order of volatility

Collection priority from most to least perishable: memory and network state, then disk, then backups and archival media. It prevents loss of transient evidence during acquisition.

Subpoena versus warrant

A subpoena compels documents or testimony, while a warrant requires probable cause and a judge's approval. Certain stored content and premises searches need a warrant.

Business records exception

A hearsay exception admitting records made in the regular course of business at or near the event. Routine system and access logs often qualify when properly authenticated.

Anti-forensics

Techniques such as timestomping, log deletion, and encryption used to impede investigation. Investigators document anomalies and corroborate findings with independent network or third-party logs.