CGRC Privacy and Data Protection Flashcards

What is the significance of the E-Government Act of 2002 in the context of federal privacy requirements?

Answer: It mandated Privacy Impact Assessments for federal systems collecting PII

The E-Government Act of 2002 requires federal agencies to conduct and publish PIAs before developing or procuring IT systems that collect, maintain, or disseminate PII.

Which concept ensures that individuals are informed about how their PII will be collected, used, and shared before collection occurs?

Answer: Informed consent and notice

Privacy notice and consent principles require organizations to transparently communicate data practices so individuals can make informed decisions about sharing their information.

In the RMF, at which step are privacy controls first formally selected for a federal information system?

Answer: Step 2 – Select

Privacy controls, along with security controls, are formally selected during Step 2 (Select) of the RMF based on the system's impact categorization and privacy requirements.

Which privacy principle requires that PII only be used for the purpose for which it was originally collected?

Answer: Purpose specification and use limitation

The use limitation principle, part of the Fair Information Practice Principles (FIPPs), restricts use of PII to the specified purpose stated at the time of collection.

What is a Privacy Breach, as commonly defined in federal guidance?

Answer: The loss, theft, or unauthorized access, use, or disclosure of PII

A privacy breach involves the compromised security, confidentiality, or integrity of PII, including unauthorized access, use, disclosure, modification, or destruction.

Which of the following best describes the relationship between security and privacy under the CGRC framework?

Answer: Security is a prerequisite for privacy, but privacy requirements extend beyond security controls

Security controls protect confidentiality, integrity, and availability of information, but privacy also requires addressing data minimization, notice, consent, and individual rights beyond traditional security.