ABOUT THE AUTHORS Mike Chapple, PhD, CIPP/US, is Teaching Professor of Information Technology, Analytics, and Operations at Notre Dame’s Mendoza College of Business. He is the bestselling author of over 25 technical books. He is also the Academic Director of the University’s Master of Science in Business Analytics program. Joe Shelley, CIPP/US, is the Vice President for Libraries and Information Technology at Hamilton College in New York. He oversees the information security and privacy programs, IT risk management, business intelligence and analytics, and data governance.

• Introduction xxiAssessment Test xxxiAnswers to Assessment Test xxxvChapter 1 Privacy in the Modern Era 1Introduction to Privacy 2What Is Privacy? 3What Is Personal Information? 4What Isn’t Personal Information? 5Why Should We Care About Privacy? 7Generally Accepted Privacy Principles 8Management 9Notice 9Choice and Consent 10Collection 10Use, Retention, and Disposal 11Access 11Disclosure to Third Parties 12Security for Privacy 12Quality 14Monitoring and Enforcement 14Developing a Privacy Program 15Crafting Strategy, Goals, and Objectives 15Appointing a Privacy Official 16Privacy Roles 17Building Inventories 18Conducting a Privacy Assessment 18Implementing Privacy Controls 20Ongoing Operation and Monitoring 20Online Privacy 20Privacy Notices 21Privacy and Cybersecurity 21Cybersecurity Goals 22Relationship Between Privacy and Cybersecurity 23Privacy by Design 24Summary 25Exam Essentials 25Review Questions 27Chapter 2 Legal Environment 31Branches of Government 32Legislative Branch 32Executive Branch 33Judicial Branch 34Understanding Laws 36Sources of Law 36Analyzing a Law 41Legal Concepts 43Legal Liability 44Torts and Negligence 45Summary 46Exam Essentials 46Review Questions 48Chapter 3 Regulatory Enforcement 53Federal Regulatory Authorities 54Federal Trade Commission 54Federal Communications Commission 60Department of Commerce 61Department of Health and Human Services 61Banking Regulators 62Department of Education 63State Regulatory Authorities 63Self-Regulatory Programs 64Payment Card Industry 65Advertising 65Trust Marks 66Safe Harbors 66Summary 67Exam Essentials 68Review Questions 69Chapter 4 Information Management 73Data Governance 74Building a Data Inventory 74Data Classification 75Data Flow Mapping 77Data Lifecycle Management 78Workforce Training 79Cybersecurity Threats 80Threat Actors 81Incident Response 86Phases of Incident Response 86Preparation 87Detection and Analysis 88Containment, Eradication, and Recovery 88Post-Incident Activity 88Building an Incident Response Plan 90Data Breach Notification 93Vendor Management 93Summary 95Exam Essentials 95Review Questions 97Chapter 5 Private Sector Data Collection 101FTC Privacy Protection 103General FTC Privacy Protection 103The Children’s Online Privacy Protection Act (COPPA) 104Future of Federal Enforcement 107Medical Privacy 110The Health Insurance Portability and Accountability Act (HIPAA) 111The Health Information Technology for Economic and Clinical Health Act 119The 21st Century Cures Act 120Confidentiality of Substance Use Disorder Patient Records Rule 121Financial Privacy 122Privacy in Credit Reporting 122Gramm–Leach–Bliley Act (GLBA) 125Red Flags Rule 129Consumer Financial Protection Bureau 130Educational Privacy 131Family Educational Rights and Privacy Act (FERPA) 131Telecommunications and Marketing Privacy 132Telephone Consumer Protection Act (TCPA) and Telemarketing Sales Rule (TSR) 133The Junk Fax Prevention Act (JFPA) 136Controlling the Assault of Non-solicited Pornography and Marketing (CAN-SPAM) Act 136Telecommunications Act and Customer Proprietary Network Information 138Cable Communications Policy Act 139Video Privacy Protection Act (VPPA) of 1988 140Driver’s Privacy Protection Act (DPPA) 141Digital Advertising and Data Ethics 142Web Scraping 143Summary 143Exam Essentials 144Review Questions 146Chapter 6 Government and Court Access to Private Sector Information 151Law Enforcement and Privacy 152Access to Financial Data 153Access to Communications 157National Security and Privacy 162Foreign Intelligence Surveillance Act (FISA) of 1978 162FISA Amendments Act Section 702 164USA-PATRIOT Act 165The USA Freedom Act of 2015 167The Cybersecurity Information Sharing Act of 2015 168Civil Litigation and Privacy 169Compelled Disclosure of Media Information 170Electronic Discovery 171Summary 173Exam Essentials 173Review Questions 175Chapter 7 Workplace Privacy 179Introduction to Workplace Privacy 180Workplace Privacy Concepts 180U.S. Agencies Regulating Workplace Privacy Issues 181U.S. Antidiscrimination Laws 182Privacy Before, During, and After Employment 185Automated Employment Decision Tools 186Employee Background Screening 186Employee Monitoring 190Investigation of Employee Misconduct 194Termination of the Employment Relationship 196Summary 197Exam Essentials 198Review Questions 200Chapter 8 State Privacy Laws 205Federal Versus State Authority 206Elements of State Privacy Laws 207Applicability 207Data Subject Rights 208Privacy Notice Requirements 209Data Protection 209Enforcement 211Data Breach Notification 212Elements of State Data Breach Notification Laws 212Key Differences Among States 214Significant Developments 215Other Recent Updates to State Breach Notification Laws 218Comprehensive State Privacy Laws 220California Consumer Privacy Act (2018) and California Privacy Rights Act (2020) 220Virginia Consumer Data Protection Act 223Colorado Privacy Act 226Connecticut Data Privacy Act 229Utah 231Florida 232Oregon 234Texas 237Montana 239Subject-Specific State Privacy Laws 241Health and Genetic Information 241Online Privacy 243Biometric Information Privacy Regulations 247AI and Automated Decision-Making 249Data Brokers 250Financial Privacy 251California Financial Information Privacy Act 252Recent Developments 253Marketing Laws 254Summary 255Exam Essentials 256Review Questions 258Chapter 9 International Privacy Regulation 263International Data Transfers 264European Union General Data Protection Regulation 265Adequacy Decisions 268Binding Corporate Rules 272Standard Contractual Clauses 273Other Approved Transfer Mechanisms 273APEC Privacy Framework 274Cross-Border Enforcement Issues 276Global Privacy Enforcement Network 276Resolving Multinational Compliance Conflicts 276Summary 277Exam Essentials 277Review Questions 279Appendix Answers to Review Questions 283Chapter 1: Privacy in the Modern Era 284Chapter 2: Legal Environment 285Chapter 3: Regulatory Enforcement 287Chapter 4: Information Management 289Chapter 5: Private Sector Data Collection 291Chapter 6: Government and Court Access to Private Sector Information 293Chapter 7: Workplace Privacy 294Chapter 8: State Privacy Laws 296Chapter 9: International Privacy Regulation 298Index 301

ABOUT THE AUTHORS Mike Chapple, PhD, CIPP/US, is Teaching Professor of Information Technology, Analytics, and Operations at Notre Dame’s Mendoza College of Business. He is the bestselling author of over 25 technical books. He is also the Academic Director of the University’s Master of Science in Business Analytics program. Joe Shelley, CIPP/US, is the Vice President for Libraries and Information Technology at Hamilton College in New York. He oversees the information security and privacy programs, IT risk management, business intelligence and analytics, and data governance.

• Introduction xxiAssessment Test xxxiAnswers to Assessment Test xxxvChapter 1 Privacy in the Modern Era 1Introduction to Privacy 2What Is Privacy? 3What Is Personal Information? 4What Isn’t Personal Information? 5Why Should We Care About Privacy? 7Generally Accepted Privacy Principles 8Management 9Notice 9Choice and Consent 10Collection 10Use, Retention, and Disposal 11Access 11Disclosure to Third Parties 12Security for Privacy 12Quality 14Monitoring and Enforcement 14Developing a Privacy Program 15Crafting Strategy, Goals, and Objectives 15Appointing a Privacy Official 16Privacy Roles 17Building Inventories 18Conducting a Privacy Assessment 18Implementing Privacy Controls 20Ongoing Operation and Monitoring 20Online Privacy 20Privacy Notices 21Privacy and Cybersecurity 21Cybersecurity Goals 22Relationship Between Privacy and Cybersecurity 23Privacy by Design 24Summary 25Exam Essentials 25Review Questions 27Chapter 2 Legal Environment 31Branches of Government 32Legislative Branch 32Executive Branch 33Judicial Branch 34Understanding Laws 36Sources of Law 36Analyzing a Law 41Legal Concepts 43Legal Liability 44Torts and Negligence 45Summary 46Exam Essentials 46Review Questions 48Chapter 3 Regulatory Enforcement 53Federal Regulatory Authorities 54Federal Trade Commission 54Federal Communications Commission 60Department of Commerce 61Department of Health and Human Services 61Banking Regulators 62Department of Education 63State Regulatory Authorities 63Self-Regulatory Programs 64Payment Card Industry 65Advertising 65Trust Marks 66Safe Harbors 66Summary 67Exam Essentials 68Review Questions 69Chapter 4 Information Management 73Data Governance 74Building a Data Inventory 74Data Classification 75Data Flow Mapping 77Data Lifecycle Management 78Workforce Training 79Cybersecurity Threats 80Threat Actors 81Incident Response 86Phases of Incident Response 86Preparation 87Detection and Analysis 88Containment, Eradication, and Recovery 88Post-Incident Activity 88Building an Incident Response Plan 90Data Breach Notification 93Vendor Management 93Summary 95Exam Essentials 95Review Questions 97Chapter 5 Private Sector Data Collection 101FTC Privacy Protection 103General FTC Privacy Protection 103The Children’s Online Privacy Protection Act (COPPA) 104Future of Federal Enforcement 107Medical Privacy 110The Health Insurance Portability and Accountability Act (HIPAA) 111The Health Information Technology for Economic and Clinical Health Act 119The 21st Century Cures Act 120Confidentiality of Substance Use Disorder Patient Records Rule 121Financial Privacy 122Privacy in Credit Reporting 122Gramm–Leach–Bliley Act (GLBA) 125Red Flags Rule 129Consumer Financial Protection Bureau 130Educational Privacy 131Family Educational Rights and Privacy Act (FERPA) 131Telecommunications and Marketing Privacy 132Telephone Consumer Protection Act (TCPA) and Telemarketing Sales Rule (TSR) 133The Junk Fax Prevention Act (JFPA) 136Controlling the Assault of Non-solicited Pornography and Marketing (CAN-SPAM) Act 136Telecommunications Act and Customer Proprietary Network Information 138Cable Communications Policy Act 139Video Privacy Protection Act (VPPA) of 1988 140Driver’s Privacy Protection Act (DPPA) 141Digital Advertising and Data Ethics 142Web Scraping 143Summary 143Exam Essentials 144Review Questions 146Chapter 6 Government and Court Access to Private Sector Information 151Law Enforcement and Privacy 152Access to Financial Data 153Access to Communications 157National Security and Privacy 162Foreign Intelligence Surveillance Act (FISA) of 1978 162FISA Amendments Act Section 702 164USA-PATRIOT Act 165The USA Freedom Act of 2015 167The Cybersecurity Information Sharing Act of 2015 168Civil Litigation and Privacy 169Compelled Disclosure of Media Information 170Electronic Discovery 171Summary 173Exam Essentials 173Review Questions 175Chapter 7 Workplace Privacy 179Introduction to Workplace Privacy 180Workplace Privacy Concepts 180U.S. Agencies Regulating Workplace Privacy Issues 181U.S. Antidiscrimination Laws 182Privacy Before, During, and After Employment 185Automated Employment Decision Tools 186Employee Background Screening 186Employee Monitoring 190Investigation of Employee Misconduct 194Termination of the Employment Relationship 196Summary 197Exam Essentials 198Review Questions 200Chapter 8 State Privacy Laws 205Federal Versus State Authority 206Elements of State Privacy Laws 207Applicability 207Data Subject Rights 208Privacy Notice Requirements 209Data Protection 209Enforcement 211Data Breach Notification 212Elements of State Data Breach Notification Laws 212Key Differences Among States 214Significant Developments 215Other Recent Updates to State Breach Notification Laws 218Comprehensive State Privacy Laws 220California Consumer Privacy Act (2018) and California Privacy Rights Act (2020) 220Virginia Consumer Data Protection Act 223Colorado Privacy Act 226Connecticut Data Privacy Act 229Utah 231Florida 232Oregon 234Texas 237Montana 239Subject-Specific State Privacy Laws 241Health and Genetic Information 241Online Privacy 243Biometric Information Privacy Regulations 247AI and Automated Decision-Making 249Data Brokers 250Financial Privacy 251California Financial Information Privacy Act 252Recent Developments 253Marketing Laws 254Summary 255Exam Essentials 256Review Questions 258Chapter 9 International Privacy Regulation 263International Data Transfers 264European Union General Data Protection Regulation 265Adequacy Decisions 268Binding Corporate Rules 272Standard Contractual Clauses 273Other Approved Transfer Mechanisms 273APEC Privacy Framework 274Cross-Border Enforcement Issues 276Global Privacy Enforcement Network 276Resolving Multinational Compliance Conflicts 276Summary 277Exam Essentials 277Review Questions 279Appendix Answers to Review Questions 283Chapter 1: Privacy in the Modern Era 284Chapter 2: Legal Environment 285Chapter 3: Regulatory Enforcement 287Chapter 4: Information Management 289Chapter 5: Private Sector Data Collection 291Chapter 6: Government and Court Access to Private Sector Information 293Chapter 7: Workplace Privacy 294Chapter 8: State Privacy Laws 296Chapter 9: International Privacy Regulation 298Index 301