Legal Frameworks & Regulatory Standards Flashcards

Under the Electronic Communications Privacy Act (ECPA), a law enforcement agency seeking stored email content more than 180 days old must obtain:

Answer: A search warrant

After the Sixth Circuit's Warshak decision and subsequent DOJ policy, a search warrant supported by probable cause is required to obtain stored email content regardless of age.

In a civil litigation context, what is the primary purpose of a litigation hold notice?

Answer: To suspend routine document destruction to preserve potentially relevant evidence

A litigation hold notice instructs custodians to suspend normal retention/destruction schedules and preserve documents potentially relevant to anticipated or pending litigation.

The USA PATRIOT Act expanded which government authority to allow collection of 'tangible things' relevant to a terrorism investigation without a traditional warrant?

Answer: Section 215 business records authority

Section 215 of the PATRIOT Act (amending FISA) allowed the FBI to obtain a FISA court order for any tangible things relevant to a terrorism or intelligence investigation.

A forensic examiner discovers evidence of a crime unrelated to the original search warrant scope during a digital examination. Under the 'plain view' doctrine, seizure of that evidence is lawful if:

Answer: The incriminating nature of the evidence is immediately apparent without further analysis

Plain view seizure requires that the item's incriminating nature be immediately apparent — the examiner cannot conduct additional analysis to determine whether something is evidence.

Which regulatory framework requires financial institutions to file a Suspicious Activity Report (SAR) within 30 calendar days of detecting a suspicious transaction?

Answer: Bank Secrecy Act / FinCEN regulations

The Bank Secrecy Act, implemented through FinCEN regulations, requires covered financial institutions to file SARs within 30 days of identifying a suspicious transaction.

Under Federal Rule of Civil Procedure 26(a)(2)(B), a retained expert witness must provide a written report that includes all of the following EXCEPT:

Answer: The identity of all co-workers who assisted in preparing the report

FRCP 26(a)(2)(B) requires disclosure of opinions, basis and reasons, data considered, exhibits, qualifications, prior testimony, and compensation — but not identification of assisting staff.

The General Data Protection Regulation (GDPR) requires organizations to report a personal data breach to the supervisory authority within:

Answer: 72 hours of discovery

GDPR Article 33 requires notification to the competent supervisory authority within 72 hours of becoming aware of a personal data breach, where feasible.