Technology & Online Privacy Flashcards

When a company uses a cloud service provider to process personal data on its behalf, the cloud provider is typically considered a:

Answer: Service provider or data processor

A cloud provider processing data on behalf of a customer acts as a service provider or processor, bound by the customer's instructions and applicable contractual obligations.

The FTC's approach to mobile app privacy requires that apps:

Answer: Honor the privacy promises they make to users and avoid deceptive practices

Under Section 5 of the FTC Act, mobile apps must honor their stated privacy policies and not engage in deceptive or unfair data practices.

IoT (Internet of Things) devices present heightened privacy risks primarily because:

Answer: They continuously collect and transmit data, often without meaningful user notice or awareness

IoT devices often collect sensitive data about users' behaviors and environments continuously and transmit it to manufacturers or third parties, frequently without prominent disclosure.

Which document established the FTC's framework recommending that companies build privacy protections into their practices from the start rather than as an afterthought?

Answer: Protecting Consumer Privacy in an Era of Rapid Change (FTC Privacy Report)

The FTC's 2012 report 'Protecting Consumer Privacy in an Era of Rapid Change' recommended privacy by design, simplified consumer choice, and greater transparency as core principles.

Under the Family Educational Rights and Privacy Act (FERPA), educational records may generally be disclosed to third parties without student consent only when:

Answer: A recognized exception applies, such as a school official with a legitimate educational interest

FERPA permits disclosure of educational records without consent in specific circumstances, including to school officials with legitimate educational interests.

The Driver's Privacy Protection Act (DPPA) restricts state DMVs from disclosing personal information contained in motor vehicle records except for:

Answer: Permissible uses enumerated in the statute, such as government functions or litigation

The DPPA prohibits state DMVs from disclosing personal information from motor vehicle records except for the specific permissible uses listed in the statute.