IAPP Memorize Nov 12

What federal statute protects the privacy of customer records held by financial institutions against government requests?

RFPA - Right to Financial Privacy Act restricts government access to customer bank records.

Which law requires ISPs to retain records to assist law enforcement investigations into child exploitation crimes?

Protect Act - requires ISPs to retain records and report suspected child pornography.

Which constitutional amendment protects individuals from being forced to testify against themselves, indirectly supporting personal privacy?

Fifth Amendment - protects against self-incrimination.

What are the relevant amendments for privacy?

First Amendment - Speech and religion

Fourth Amendment - protect against unreasonable searches

Fifth Amendment - Protects against self-incrimination

Fourteenth Amendment - Due Process and Equal Protection

What case established the “reasonable expectation of privacy” standard under the 4th amendment?

Katz v. United States

What case established the “third-party doctrine”?

Smith v. Maryland

What case limited access to cell-site (location) data?

Carpenter v. United States

What case addressed cell phone searches?

Riley v. California

Which states law restricts biometric data collection but does not allow private lawsuits for violations?

Washington Biometric Law and Texas Capture or Use of Biometric Identifier (CUBI) Act

Which states have broad biometric privacy specific laws? (exclude comprehensive) (3 State and Act)

Illinois - BIPA - Biometric Information Privacy Act

Texas - CUBI - Capture or Use of Biometric Identifier Act
Washington - BIPA & My Health My Data Act (MHMDA)

Which states comprehensive privacy laws include biometrics? (4 State and Act)

California - CCPA and CPRA

Colorado - Colorado Privacy Act (CPA)

Virginia - Virginia Consumer Data Protection Act (VCDPA)
New York - New York Biometric Privacy Act (BPA)

What is the Colorado biometric restriction?

Restricting the use of facial recognition tech by state and local gov.

Which US Law requires employees to keep employee medical information separate from general personnel files?

ADA

Who does HIPAA apply to?

Covered Entities

What is FCRA?

Fair Credit Reporting Act (FCRA) - consumer credit info - access, dispute, know, control access, right to your score.

What is the ECPA?

Electronic Communications Privacy Act - protects the privacy of electronic comms like emails, phone calls, and other data from unauthorized access and interception. 

What are the titles of the ECPA?

Title I - Wiretap Act: prohibit interception of electronic comms in transit w/o warrant

Title II - Stored Communications Act: Protects electronic comms stored by service providers, such as emails waiting to be accessed. Warrant.

Title III - Pen Register Act: regulates collection of metadata. Court order NOT warrant

How does the ECPA apply to employer privacy?

Employers cannot secretly monitor personal communications - allowed for work-related comms on company-owned devices.

What is the Cloud Act?

Amendment to ECPA allowing compel info from servers regardless of location (including overseas)

Which federal law requires gov agencies to obtain a warrant before accessing stored emails older than 180 days, though has faced criticism for outdated standards?

Stored Communications Act (SCA) - governs law enforcement access to stored electronic comms.

What is CALEA?

Requires carriers to assist with lawful interceptions. Design equipment to allow access.

What is FISA?

Foreign Intelligence Surveillance Act

Which state law established the first private right of action for data breach victims under state consumer privacy law?

CCPA

What is the RFPA?

Right to Financial Privacy Act - specific procedures to get info from financial institutions about customers.

Customer gets written notice and can challenge it.

What changes did the CPRA make to the CCPA?

Added new rights - correction and limit use of SPI

Established the California Privacy Protection Agency (CPPA)

Right to Opt Out of Sharing - includes selling and sharing for behavioral ads.

Automated Decision Making - opt out of profiling in automated decisions.

What is the SHIELD Act?

Law protecting journalists from revealing confidential sources.

Which states comprehensive privacy law exempted employee and B2B data until 2025?

CPRA

What is the VCDPA?

Virginia Consumer Data Protection Act

What is the CPA?

Colorado Privacy Act - unique for the universal opt out

What is the UCPA?

Utah Consumer Privacy Act

What agency enforces privacy rules specific to children’s online data?

FTC - It enforces COPPA compliance

Which branch of the US government has the power to issue executive orders that may impact privacy practices?

Executive branch

Which state privacy law requires businesses to honor universal opt-out mechanisms, such as browser signals?

CPA - Colorado Privacy Act requires honoring universal opt-out signals

Which SC case limited warrantless searches by ruling that thermal imaging of a home constituted a search under the 4th amendment?

Kylio v. United States

Which act requires telecom carriers to design systems that can accomodate lawful intercepts?

CALEA - telecom carriers must ensure systems support lawful inteception.

Which principle ensures that courts can declare laws unconstitutional if they violate privacy rights?

Judicial Review - allows courts to strike down unconstitutional laws.

Which state law gives consumers the right to opt out of the sale of their personal information to 3rd parties?

CCPA - first to grant explicit right to opt out of sale of personal information to 3rd parties.

Which Colorado state law requires businesses to conduct data protection asessments before engaging in high-risk processing such as targeted advertising?

Colorado Privacy Act (CPA)

Which federal law requires financial institutions to implement safeguards to protect customer information from unauthorized access?

Safeguards Rule (GLBA) - requires financial institutions to implement security programs. Gramm-Leach-Bliley Act.

What is the ECOA?

Equal Credit Opportunity Act is a Law prohibiting discrimination in lending

What is FACTA?

Fair and Accurate Credit Transactions Act is a Law addressing identity theft protections.

What is the Gramm-Leach-Bliley Act? (2 rules)

The GLBA is a law requiring financial institutions (banks, securities firms, insurance) to protect nonpublic personal info of consumers.

1) Financial Privacy Rule - clear privacy notices to customers and opt-out of data sharing.

2) Safeguards Rule - institutions must implement a security program to safeguard customer data.

Which state law expanded the definition of personal data in breach notifications to include health insurance info?

California Civil Code §1798.82 - General Breach Notification Statute

Which Supreme Court Case addressed warrantless collection of telephone metadata?

Smith v. Maryland - upheld the 3rd party doctrine for phone metadata (tracked outgoing calls, considered “giving” data to phone company)

Which state law prohibits companies from using student data for targeted advertising?

SOPIPA - California’s SOPIPA restricts use of student data for advertising.

What is the VPPA?

Video Privacy Protection Act - cannot disclose PII concerning video, now applies to streaming.

Which federal agency primarily enforces the Do Not Call Registry?

Federal Trade Commission (FTC) enforces the National Do Not Call Registry

Which state requires businesses to notify the AG within 30 days of discovering a breach affecting more than 250 residents?

MA

What is the NY Shield Act?

Law requiring businesses to protect the private info of NY residents. Data Security and Data Breach notification.

Which US agency enforces the Telemarketing Sales Rule (TSR)?

Federal Trade Commission enforces the TSR

Which case held that law enforcement needs a warrant to search the contents of a cellphone during an arrest?

Riley v. California - warrants are required to search cellphones incident to arrest.

What is Olmstead v. United States about?

Wiretaps w/o search warrant - overturned by Katz v. US and introduced right to be left alone.

Which state requires covered entities to implement “reasonable security” as part of its SHIELD ACT?

NY

Which federal law requires telemarketers to maintain company specific do-not-call lists?

Telephone Consumer Protection Act (TCPA)

Which US Supreme Court Case ruled that warrantless wiretaps did not violate the 4th amendment until later overturned?

Olmstead v. United States (overturned by Katz)

What is Griswold v. Connecticut about?

Contraception and marital privacy. Bill of Rights had implied right to privacy.

Which law prohibits financial institutions from sharing account numbers with nonaffiliated 3rd parties for marketing purposes?

Gramm-Leach-Bliley Act (GLBA) - opt out is not enough

Which law requires background check disclosures be clear and in a stand-alone format separate from other application materials?

Fair Credit Reporting Act (FCRA) - clear, stand-alone disclosures before obtaining a background check.

What is FCRA?

Fair Credit Reporting Act - regulates accuracy and use of consumer credit reports, how reporting agencies (CRAs) can use the data, and grants customers right to access their own info and dispute innacuracies.

Regulates Data Use and Data Security

Also applies to background checks for employment purposes, including applicants consent and report and copy of the report if adverse action (like not hiring) based on it.

Which investigative tool authorized under the Patriot Act allows delayed notification of a search to the target?

Delayed Notice Warrant

What is the Patriot Act?

1) expanded surveillance power

2) stronger financial regulations - must report suspicious transactions.

3) created NSLs - request records without a court order.

Lone wolf provision and roving wiretaps expired.

What is a National Security Letter?

Document by law enforcement to copel companies to provide info for national security investigations. Administrative subpoena that DOES NOT require prior judicial approval and includes a nondisclosure requirement.

What is the USA Freedom Act?

1) ends bulk data collection, need “specific selection term” and court order.

2) oversight - amicus curiae panel to advise FISA court

3) Modified NSLs - can only be used if real national security risk, companies can challenge.

What legal tool allows law enforcement to compel testimony or documents without needing probable cause?

Subpoena - compel testimony or documents with a lower standard than warrants.

What is FISA?

Foreign Intelligence Surveillance Act

Framework for electronic surveillance and physical search for foreign intelligence

Created FISC courts to oversee

allowed to collect foreign intel on non-US persons outside the US

Inside the US or on americns warrants are needed. Strict rules for US citizens.

What law sets standards for unsolicited fax advertisements?

Telephone Consumer Protection Act (TCPA)

What is CAN-SPAM?

Primarily unsolicted commercial email, also applies to social media and text. “Is the message’s primary purpose commercial”?

ID advertising, use accurate info, have opt-out methods