US DPO flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

FTC Act Section 5

Federal statute prohibiting unfair or deceptive acts or practices in commerce; the FTC uses it to enforce privacy promises and inadequate security, though it lacks general first-violation civil penalties.

Privacy Act of 1974

Governs federal agencies' systems of records retrievable by personal identifier, granting individuals access, amendment, and accounting-of-disclosure rights with civil remedies.

COPPA

Federal law requiring operators of child-directed sites to obtain verifiable parental consent before collecting personal information from children under 13, with data minimization duties.

HIPAA Breach Notification Rule

Requires covered entities to notify affected individuals within 60 days of discovering a breach; breaches affecting 500 or more people also require HHS and media notice.

CCPA/CPRA Applicability

Applies to for-profit businesses doing business in California with over $25M revenue, 100,000+ consumers' data, or 50%+ revenue from selling or sharing personal information.

Global Privacy Control

A browser or device signal communicating opt-out of sale and sharing; CPRA and several state laws require businesses to honor it as a valid opt-out.

Sensitive Data Opt-In

Many state laws require opt-in consent or a right to limit before processing sensitive categories such as SSN, precise geolocation, health, biometric, or genetic data.

Illinois BIPA

State biometric privacy law requiring written notice and consent before collecting biometric identifiers, with a private right of action and statutory damages per violation.

NIST Privacy Framework

Voluntary framework organized around Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P functions to help organizations manage privacy risk.

Records of Processing Activities

Inventory documenting each processing activity's purpose, data categories, subjects, recipients, retention, and cross-border transfers, supporting accountability and regulatory requests.

Privacy by Design

Design principle embedding privacy into systems and defaults, including data minimization, purpose limitation, and protections that apply without user action.

RACI Matrix

Governance tool assigning Responsible, Accountable, Consulted, and Informed roles to privacy activities, clarifying ownership across business units and the privacy office.

Data Classification

Scheme (e.g., public, internal, confidential, restricted) that determines handling, access, and protection requirements based on sensitivity and regulatory obligations.

Right to Know

Consumer right to request disclosure of categories and specific pieces of personal information collected, sources, purposes, and third parties receiving it.

DSR Verification

Process of confirming a requester's identity proportionate to data sensitivity, using only information necessary and avoiding excessive collection during verification.

Authorized Agent

Person or entity submitting a data subject request on a consumer's behalf, subject to verification and, in some states, written permission from the consumer.

Consent Withdrawal

Right to revoke previously given consent as easily as it was given, requiring systems to record and propagate the change to downstream processing.

DPIA Triggers

Conditions requiring assessment, including new technology, sensitive data, large-scale monitoring, profiling, or processing that presents heightened risk of harm.

LINDDUN

Privacy threat modeling framework covering linking, identifying, non-repudiation, detecting, data disclosure, unawareness, and non-compliance threats.

Residual Risk

Risk remaining after mitigations are applied; high residual risk may require senior approval or consultation before processing proceeds.

Risk Treatment Options

Choices for handling identified risk: avoid, mitigate, transfer through contract or insurance, or accept with documented rationale and owner.

Data Privacy Framework

EU-US adequacy mechanism effective 2023 allowing transfers to certified US organizations, replacing Privacy Shield after its invalidation in Schrems II.

Standard Contractual Clauses

Pre-approved contract terms enabling transfers from the EU; post-Schrems II they require a transfer impact assessment and supplementary safeguards.

Vendor Risk Tiering

Classification of vendors by data sensitivity and criticality to determine due diligence depth, contract terms, and reassessment frequency.

Subprocessor Flow-Down

Contractual requirement extending privacy and security obligations to a vendor's subcontractors, with notice or approval rights for the primary controller.

State Breach Notification

All 50 states require notice of breaches of defined personal information, typically without unreasonable delay and often within 30 or 45 days.

GDPR 72-Hour Rule

Requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach where feasible, unless unlikely to result in risk.

NIST SP 800-61

Incident handling guide defining phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident activity.

Encryption Safe Harbor

Many state breach laws exempt notification when breached data was encrypted and the key was not compromised, provided the encryption was not rendered ineffective.

Role-Based Training

Privacy training tailored to function (engineering, marketing, HR) covering handling rules, incident reporting, and escalation, refreshed annually with tracked completion.

DSR Cycle Time

Operational metric measuring time from request intake to completion, used to monitor compliance with statutory response deadlines and process efficiency.

Control Testing

Audit activity sampling and verifying that privacy controls operate as designed, producing evidence that supports remediation and continuous improvement.