Regulatory Policy & Ethical Standards Flashcards

Which GDPR lawful basis requires a balancing test between the organization's interests and the individual's rights?

Answer: Legitimate interests

Legitimate interests requires a purpose test, necessity test, and balancing test against data subjects' rights.

Under the Fair Credit Reporting Act, what must a company provide when it takes adverse action based on a consumer report?

Answer: An adverse action notice

FCRA requires an adverse action notice identifying the consumer reporting agency and the consumer's rights.

Which statement best distinguishes anonymization from pseudonymization under GDPR?

Answer: Anonymized data is outside GDPR scope, while pseudonymized data is still personal data

Pseudonymized data can be re-identified with additional information and remains personal data, while truly anonymized data does not.

Which federal agency is the primary U.S. enforcer against unfair or deceptive data privacy practices under Section 5 of its governing act?

Answer: Federal Trade Commission

The FTC uses Section 5 of the FTC Act to act against unfair or deceptive privacy and data security practices.

Under the Equal Credit Opportunity Act, a lender using a complex machine learning model must still be able to:

Answer: Provide specific principal reasons for credit denial

ECOA and Regulation B require specific reasons for adverse action, regardless of model complexity.

GDPR Article 30 requires controllers to maintain which artifact, which supports a CDO's data inventory efforts?

Answer: Records of processing activities

Article 30 requires records of processing activities documenting purposes, categories of data, recipients, and retention.

Which U.S. law protects the privacy of student education records at institutions receiving federal funding?

Answer: FERPA

The Family Educational Rights and Privacy Act governs access to and disclosure of student education records.