Glossary

Law including provisions promoting interoperability and prohibiting information blocking of electronic health information.

Individual rights to review personal information held about them and to request corrections.

The principle that organizations are responsible for, and can demonstrate, compliance with privacy obligations.

A determination that a non-EU country provides an adequate level of data protection, permitting transfers without additional safeguards.

A denial or unfavorable change (e.g., credit, employment) based on a consumer report, triggering FCRA notice requirements.

Combining individual data points into group-level statistics that do not identify specific individuals.

Limits employer medical inquiries and exams and requires confidentiality of employee medical information.

A privacy tort for using a person's name or likeness for commercial benefit without consent; related to the right of publicity.

Equipment that stores or produces and dials numbers; its use to call cell phones without consent is restricted under the TCPA.

Pre-employment checks (criminal, credit, references); when done via a CRA, governed by the FCRA and state 'ban-the-box' laws.

Anti-money-laundering law requiring financial institutions to report certain transactions, in tension with financial privacy.

Internal data-transfer rules approved by EU regulators for transfers within a corporate group.

Illinois law requiring notice and consent for collecting biometric identifiers; notable for its private right of action.

State (and some federal) laws requiring notice to affected individuals (and sometimes regulators) after a breach of personal information.

Policies allowing personal devices for work, raising privacy and security issues around monitoring and data separation.

The entity that collects personal information from California consumers and determines the purposes and means of processing. Roughly equivalent to a data controller.

Course relevance: Only applies in California. The gap: no federal equivalent means businesses face different obligations depending on where their users are located.

A person or entity that performs functions involving PHI on behalf of a covered entity; bound by a business associate agreement.

A required contract obligating a business associate to safeguard PHI consistent with HIPAA.

HIPAA equivalent of a sub-processor: a third party engaged by the business associate. Required to sign agreements flowing down from the business associate.

Course relevance: In practice these agreements are often inadequate or missing. Accountability thins with each link in the chain.

1984 law restricting cable operators' collection and disclosure of subscriber personally identifiable information.

2018 California law granting consumers rights to know, delete, and opt out of the sale of their personal information.

The agency created by the CPRA to implement and enforce California consumer privacy law.

2020 ballot measure amending the CCPA; added rights (correction, limiting sensitive PI), new categories, and the California Privacy Protection Agency.

2003 law regulating commercial email; requires accurate headers, a functioning opt-out, identification as an ad, and a valid physical address.

2018 Supreme Court case holding that accessing historical cell-site location information is a Fourth Amendment search requiring a warrant, narrowing the third-party doctrine.

1998 law requiring verifiable parental consent before collecting personal information online from children under 13; enforced by the FTC.

Giving individuals control over the use of their data, through opt-in (affirmative) or opt-out (default-permitted) mechanisms.

Federal policy (45 CFR 46) governing the ethical conduct of human-subjects research, including informed consent and IRB review.

1994 law requiring telecom carriers to build interception capabilities into their networks for lawful surveillance.

Federal anti-hacking statute prohibiting unauthorized access to protected computers.

A binding settlement (often 20 years) the FTC enters with a company, imposing privacy/security obligations and audits without an admission of liability.

Federal agency created by Dodd-Frank that regulates consumer financial products and shares GLBA-related authority.

Information from a CRA bearing on a consumer's creditworthiness, character, or reputation used for credit, employment, insurance, or similar purposes.

An entity that compiles and sells consumer reports (e.g., credit bureaus); regulated under the FCRA.

Added by the CPRA. Similar to a service provider but for different processing contexts. Expands the category of entities subject to contractual data protection obligations.

Course relevance: An attempt to close the gap that allows entities to receive data without taking on service-provider obligations. Whether it succeeds is a live legal question.

A small file a website stores in a browser to remember information; central to online tracking and behavioral advertising debates.

Under HIPAA, a health plan, health care clearinghouse, or health care provider that transmits health information electronically.

Telecom data about a customer's use of services (e.g., call detail); protected under the Telecommunications Act and FCC rules.

The technical role responsible for storing and maintaining data safely. Distinct from the data owner or steward who makes decisions about it — the IT function in the chain.

Course relevance: The accountability question: when harm occurs, is the custodian responsible for how the data was stored, or only for following the owner's instructions?

An emerging concept: an entity that owes a legal duty of loyalty to the data subject, similar to how a financial advisor owes a fiduciary duty to a client. Not yet standard in US law.

Course relevance: The argument that controllers should be legally obligated to act in the interest of the data subject, not just their own commercial interest. India has experimented with this; it appears in some US legislative proposals.

The business unit or individual accountable for a specific data asset within an organization. Decides who can access it and approves its use. A governance term, not a legal one.

Course relevance: Internal accountability anchor. When governance structures fail, identifying who the data owner was — and whether they fulfilled their obligations — is often where the analysis starts.

A company that aggregates and sells personal information about consumers, often without a direct relationship with them.

A contract between a controller and processor specifying what the processor can and cannot do with the data. Required under GDPR. Defines purpose limitation, security obligations, sub-processor authorization, and breach notification.

Course relevance: The governance document that is supposed to make the processor relationship accountable. The course examines what happens when DPAs are absent, inadequate, or unenforced.

A designated individual within an organization responsible for overseeing data protection compliance. Required under GDPR for certain organizations.

Course relevance: The person whose job is to ask whether what the organization is doing is legal and ethical. Week 13 asks what happens when they are ignored.

Any entity to whom data is disclosed. Broader than 'processor' — includes third parties who receive data as part of legitimate business operations.

Course relevance: The aggregation problem lives here. Each recipient may recombine data with their own sources in ways the data subject never anticipated.

An internal role responsible for the quality, integrity, and appropriate use of specific data assets within an organization. Not a legal term — a governance term.

Course relevance: The person inside the organization who is supposed to care about the data as a professional obligation. Week 13 asks what happens when they are overruled.

Federal agency that issues and enforces HIPAA rules, primarily through its Office for Civil Rights.

Self-regulatory body for online behavioral advertising, known for the AdChoices icon and opt-out program.

FACTA rule requiring reasonable measures to properly dispose of consumer report information to protect against unauthorized access.

2010 financial-reform law that created the CFPB and added consumer financial protections.

1994 law restricting disclosure and use of personal information from state motor-vehicle records.

Law requiring federal agencies to conduct Privacy Impact Assessments for systems handling personal information.

1986 law governing interception and access to electronic communications; includes the Wiretap Act, Stored Communications Act, and Pen Register Act.

Generally prohibits private employers from using lie-detector tests on employees and applicants.

A prior or existing relationship that can serve as a limited exception to certain Do-Not-Call/telemarketing restrictions.

Mechanism allowing certified U.S. organizations to receive personal data from the EU consistent with EU adequacy requirements.

2003 FCRA amendment adding identity-theft protections, free annual credit reports, the Red Flags Rule, and the Disposal Rule.

1970 law regulating consumer reporting agencies and the collection, use, and accuracy of consumer report (credit) information.

1974 law protecting the privacy of student education records and giving parents/eligible students access and amendment rights.

When employers use third parties for background checks, the FCRA requires disclosure, written consent, and pre/post-adverse-action notices.

Regulates interstate communications; enforces telecom privacy rules such as CPNI, the TCPA, and Do-Not-Call provisions.

Law requiring federal agencies to develop and implement information security programs.

Primary U.S. federal privacy and consumer-protection regulator; enforces against unfair or deceptive practices under Section 5 of the FTC Act.

First-party data is collected by an organization directly from its users; third-party data is obtained from outside sources/trackers.

1978 law establishing procedures and a special court (FISC) for foreign-intelligence surveillance.

Constitutional protection against unreasonable searches and seizures by the government; the basis for many privacy protections against state actors.

Law granting public access to federal agency records, subject to exemptions including one for personal privacy.

Prohibits 'unfair or deceptive acts or practices' (UDAP) in commerce; the FTC's main authority to police broken privacy promises and unfair data practices.

A privacy framework (AICPA/CICA) of ten principles for managing and evaluating privacy.

Under GINA, employers generally may not request, require, or use employees' genetic information.

2008 law prohibiting discrimination based on genetic information in health insurance and employment.

Requires financial institutions to give privacy notices and let consumers opt out of certain sharing of NPI with nonaffiliated third parties.

Requires financial institutions to maintain a written information security program to protect customer information.

1999 law governing how financial institutions collect, use, and protect consumers' nonpublic personal information; includes the Privacy Rule and Safeguards Rule.

1965 Supreme Court case recognizing a constitutional right to privacy in marital/contraceptive decisions, inferred from several amendments.

1996 law that, with its rules, governs the privacy and security of protected health information held by covered entities and business associates.

An individual's signed permission required for uses/disclosures of PHI not otherwise permitted, such as most marketing.

Sets national standards for the use and disclosure of PHI and gives individuals rights over their health information.

Requires administrative, physical, and technical safeguards to protect electronic PHI (ePHI).

2009 law that strengthened HIPAA, added breach-notification requirements, and extended direct liability to business associates.

The fraudulent use of another person's personal information, typically for financial gain.

A documented process for detecting, containing, investigating, and remediating privacy/security incidents and breaches.

The right or ability to determine what personal information is collected, how it is used, and to whom it is disclosed.

A privacy tort for intentionally intruding on someone's solitude or private affairs in a manner highly offensive to a reasonable person.

Two or more entities that jointly determine the purposes and means of processing. They share accountability and liability.

Course relevance: Facebook and Cambridge Analytica were arguably joint controllers. Both pointed at each other; neither was adequately held accountable in real time.

2005 law amending the TCPA to restrict unsolicited fax advertisements and require opt-out notices.

1967 Supreme Court case establishing that the Fourth Amendment protects people, not places, and creating the reasonable-expectation-of-privacy test.

HIPAA principle that uses and disclosures of PHI be limited to the least amount needed to accomplish the purpose.

A list consumers join to stop most telemarketing calls; telemarketers must scrub their lists against it.

Protects employees' concerted activity, which can limit how employers monitor or restrict workplace communications.

Self-regulatory organization of third-party digital advertising companies offering an opt-out mechanism.

A voluntary NIST framework to help organizations identify and manage privacy risk.

Under the GLBA, personally identifiable financial information a consumer provides to a financial institution that is not publicly available.

Informing individuals about an organization's information practices, typically via a privacy notice or policy.

The HHS office that enforces the HIPAA Privacy, Security, and Breach Notification Rules.

Tracking a user's online activity over time to deliver targeted ads; subject to self-regulatory frameworks (DAA, NAI).

A consent model requiring an individual's affirmative action before data is collected or used.

A consent model permitting use unless the individual takes action to decline.

Devices/processes capturing dialing, routing, and signaling information (not content); governed by ECPA Title III.

Under the FCRA, the limited legitimate reasons (e.g., credit, employment, insurance) for which a consumer report may be obtained.

When federal law overrides conflicting state law; many U.S. privacy laws set a federal floor while allowing stricter state laws (no field preemption).

Obtaining personal information under false pretenses; prohibited by the GLBA.

The TCPA standard required before sending telemarketing robocalls/texts to consumers.

The right to be let alone, and the ability of individuals to control the collection, use, and disclosure of their personal information.

Governs federal agencies' collection, use, and disclosure of personally identifiable records in systems of records; gives individuals access and amendment rights.

A process to evaluate and mitigate privacy risks of a system or initiative that handles personal information.

Former EU-U.S. (and Swiss-U.S.) transfer framework invalidated by the Schrems II decision in 2020.

Four common-law privacy torts: intrusion upon seclusion, public disclosure of private facts, false light, and appropriation of name or likeness.

A statutory provision allowing individuals (not just regulators) to sue for violations; present in laws like the TCPA, VPPA, BIPA, and parts of the CCPA.

Under HIPAA, individually identifiable health information held or transmitted by a covered entity or business associate.

Law governing surveys, evaluations, and the collection of information from students for marketing purposes in schools.

Two-part test (from Katz) asking whether a person exhibited an actual expectation of privacy that society recognizes as reasonable.

Requires certain financial institutions and creditors to implement programs to detect and respond to identity-theft warning signs.

1978 law limiting federal government access to customers' financial records held by banks.

Many breach-notification laws excuse notice if the breached data was encrypted and the key was not compromised.

2020 EU Court of Justice decision invalidating Privacy Shield and adding scrutiny to SCC-based transfers to the U.S.

The U.S. model of regulating privacy industry-by-industry (health, finance, telecom) rather than via one comprehensive law.

Industry-developed privacy codes and enforcement (e.g., DAA, NAI, PCI DSS) supplementing or filling gaps in law.

PII that carries heightened risk if disclosed, such as Social Security numbers, financial account data, health information, biometrics, or precise geolocation.

Processes personal information on behalf of the business. Roughly equivalent to a data processor. Must be bound by a contract prohibiting use of the data for other purposes.

Course relevance: The contractual prohibition is only as strong as the enforcement mechanism behind it. The course asks: who enforces it, and what happens when they don't?

New York law expanding breach-notification requirements and mandating reasonable data-security safeguards.

1979 Supreme Court case establishing the third-party doctrine: no reasonable expectation of privacy in numbers dialed and shared with the phone company.

State officials with authority to enforce many federal privacy laws (e.g., HIPAA, COPPA) and state privacy and breach-notification statutes.

ECPA Title II, governing government and third-party access to stored electronic communications and records held by service providers.

A third party engaged by the processor to assist with processing. Often invisible to the data subject. The controller may not know who sub-processors are.

Course relevance: Where accountability goes dark. You consented to the app — not to its three analytics vendors, cloud provider, and AI partner.

The regulatory body that enforces data protection law in each EU member state (ICO in the UK, CNIL in France, etc.). An external check on the whole chain.

Course relevance: The enforcement mechanism. The course asks repeatedly: what happens when this mechanism fails or is absent?

Under the Privacy Act, a group of agency records retrieved by an individual's name or identifier; requires a published System of Records Notice (SORN).

Major telecom-reform law containing privacy protections including CPNI.

FTC rule implementing the Telemarketing and Consumer Fraud and Abuse Prevention Act; governs telemarketing conduct and the Do-Not-Call Registry.

1991 law restricting telemarketing calls, autodialers, prerecorded messages, and texts; includes a private right of action.

Influential 1890 Harvard Law Review article by Samuel Warren and Louis Brandeis articulating a legal 'right to be let alone'; foundational to U.S. privacy tort law.

Any entity other than the data subject, controller, processor, or supervisory authority — the catch-all for everyone else in the chain. Under the CCPA, an entity that receives personal information but is not a service provider; the key distinction is that third parties can use data for their own purposes, while service providers cannot.

Course relevance: The unregulated space — third parties are not bound by the same obligations as processors, and this is where purpose limitation breaks down. The CCPA permission structure that makes data-broker operations legal: a third party is not bound by the purpose limitation that governs service providers.

Receives data at the end of the chain. May use it for purposes the data subject never anticipated.

Course relevance: The aggregation-problem endpoint.

Principle that information voluntarily shared with a third party generally loses Fourth Amendment protection.

Core activities for which HIPAA permits PHI use/disclosure without individual authorization.

Conduct that is deceptive (a material misrepresentation likely to mislead) or unfair (causing substantial, unavoidable consumer injury not outweighed by benefits).

2015 law that curtailed bulk collection of telephone metadata and reformed certain PATRIOT Act surveillance authorities.

2001 law that expanded government surveillance and information-sharing powers after 9/11.

Due diligence and contractual controls (e.g., DPAs) over service providers that process personal information.

The reasonable-effort consent COPPA requires operators to obtain from a parent before collecting a child's personal information.

1988 law restricting disclosure of consumers' video rental/viewing records; includes a private right of action.

ECPA Title I, restricting real-time interception of the contents of wire, oral, and electronic communications.

Employer surveillance of communications and activity; constrained by ECPA exceptions (consent, business use) and state laws.