CGRC Privacy and Data Protection Flashcards

Which U.S. federal law establishes privacy and security requirements for federal agencies' handling of personally identifiable information (PII)?

Answer: The Privacy Act of 1974

The Privacy Act of 1974 governs how federal agencies collect, maintain, use, and disclose PII about individuals, granting citizens rights over their records.

What is Personally Identifiable Information (PII) as defined by NIST?

Answer: Information that can be used to distinguish or trace an individual's identity

NIST defines PII as any information that can be used alone or in combination with other information to identify, contact, or locate a specific individual.

What document must federal agencies publish to notify the public about a system that collects and maintains PII?

Answer: System of Records Notice (SORN)

A System of Records Notice (SORN) is published in the Federal Register to inform the public about a system that retrieves records by personal identifiers.

Under the CGRC framework, which assessment evaluates privacy risks associated with collecting, storing, and using PII in a federal system?

Answer: Privacy Impact Assessment (PIA)

A Privacy Impact Assessment (PIA) analyzes how PII is collected, used, shared, and protected, identifying and mitigating privacy risks.

Which NIST SP 800-53 control family specifically addresses privacy requirements integrated into the security control framework?

Answer: PT – PII Processing and Transparency

NIST SP 800-53 Rev. 5 introduced the PT (PII Processing and Transparency) family, which includes controls for consent, purpose specification, and data minimization.

What is the principle of data minimization in the context of privacy protection?

Answer: Collecting and retaining only the minimum amount of PII necessary for the stated purpose

Data minimization requires that organizations collect only the PII that is directly relevant and necessary to accomplish the specified purpose, reducing exposure risk.