Government and Public Sector Privacy Flashcards

Under FERPA, when may a school disclose a student's education records without consent?

Answer: To school officials with a legitimate educational interest, and in health or safety emergencies

FERPA permits disclosures without consent to school officials with a legitimate educational interest, in emergencies affecting health or safety, and in other specified exceptions.

Which federal privacy law applies to personal information collected by federal agency websites and online services?

Answer: E-Government Act of 2002 and OMB guidance implementing it

The E-Government Act of 2002, with OMB guidance, requires federal agencies to post privacy policies on websites and conduct privacy impact assessments for online information collections.

What is a Privacy Impact Assessment (PIA) required under the E-Government Act?

Answer: An analysis of how personal information is collected, used, and protected in a federal IT system

A PIA analyzes how personal information is collected, stored, accessed, and used in a federal IT system, and must be conducted before developing or procuring systems that collect personal data.

Under the Freedom of Information Act (FOIA), which Privacy Act exemption allows agencies to withhold personal information about individuals?

Answer: Exemption 6 (personal privacy files) and Exemption 7(C) (law enforcement records where privacy interests outweigh public interest)

FOIA Exemptions 6 and 7(C) protect personal privacy by allowing agencies to withhold information about individuals when the privacy interest outweighs the public interest in disclosure.

Which federal agency has primary responsibility for issuing government-wide privacy policy guidance to federal agencies?

Answer: Office of Management and Budget (OMB)

OMB issues government-wide privacy policy guidance, including Circular A-130, which sets requirements for privacy programs, PIAs, and SORNs across federal agencies.

The Driver's Privacy Protection Act (DPPA) restricts state DMVs from disclosing what type of information?

Answer: Personal information from motor vehicle records, such as names, addresses, and SSNs

The DPPA restricts state DMVs from disclosing personal information in motor vehicle records — like names, addresses, SSNs, and photos — except for specified permissible uses.