Certified Information Privacy Technologist: Data Privacy Frameworks and Models Flashcards

Which NIST Privacy Framework core function focuses on developing and implementing organizational activities to identify privacy risk?

Answer: Identify-P

The Identify-P function in the NIST Privacy Framework helps organizations develop an organizational understanding of privacy risk to individuals.

In the context of the ISO 29101 privacy architecture framework, what does the 'PII principal' refer to?

Answer: The individual to whom the PII relates

In ISO 29101, the PII principal is the natural person to whom the personally identifiable information relates.

A company implements a data minimization strategy where it only collects data fields absolutely necessary for a transaction. Which Fair Information Practice Principle does this best exemplify?

Answer: Collection limitation

Collection limitation is the FIPP that restricts data collection to what is necessary, relevant, and obtained fairly.

Under the APEC Privacy Framework, which principle requires organizations to give individuals an opportunity to have inaccurate data corrected?

Answer: Access and Correction

The Access and Correction principle in the APEC Privacy Framework requires that individuals be able to access their data and correct inaccuracies.

Which model explicitly uses 'contextual integrity' to evaluate whether information flows are appropriate?

Answer: Helen Nissenbaum's privacy-as-contextual-integrity model

Helen Nissenbaum's contextual integrity model holds that privacy is violated when information flows do not match the norms of the context in which data was shared.

In the GDPR's data protection framework, what is the primary legal basis for processing special categories of personal data in a workplace health context?

Answer: Explicit consent or a specific legal obligation

Article 9 GDPR requires explicit consent or a qualifying legal obligation/employment law basis to process health data as a special category.

The 'Accountability' principle in the OECD Privacy Guidelines assigns responsibility for compliance to which party?

Answer: The data controller

Under the OECD Accountability principle, the data controller is responsible for ensuring the other principles are complied with.