Data Protection & Privacy Flashcards

The Privacy Act of 1974 primarily regulates which of the following?

Answer: How federal agencies collect, maintain, use, and disclose records about individuals in a system of records

The Privacy Act governs federal agency handling of personal records retrieved by an individual's identifier.

Where must a federal agency publish a System of Records Notice (SORN)?

Answer: In the Federal Register

Agencies must publish SORNs in the Federal Register so the public knows what records exist.

An FSO must email a cleared employee's SF-86 data to a colleague who has a need-to-know. What is the best practice?

Answer: Send it only through an approved encrypted channel to the authorized person

SF-86 data is sensitive PII and must be protected in transit with encryption and limited to authorized users.

Which disposal method is appropriate for paper records containing employee SSNs?

Answer: Cross-cut shredding or equivalent destruction

PII on paper must be destroyed so it cannot be reconstructed.

A cleared employee declines to provide their SSN on the clearance application. What is the likely result?

Answer: The investigation request cannot be processed

The SSN is required to identify the subject and conduct the investigation.

Which pairing is MOST likely to enable identity theft if exposed together?

Answer: Full name, date of birth, and SSN

Name, DOB, and SSN together are the core data used to impersonate someone.

Under the Privacy Act, an individual generally has the right to do what with their agency record?

Answer: Request access to it and seek amendment of inaccurate information

The Act provides access and amendment rights, subject to exemptions.