- Welcome to Lesson 26: Deep Dive Quiz.
In 26, we summarize the elements
of effective security compliance.
In lesson 26.1 we talked about compliance monitoring
and in 26.2, well we spent a lot of time
talking about privacy principles.
So are you ready?
Let's do a five question quiz together.
I know you know how to do this,
but make sure you've got your pen or your pencil
and your paper ready
and put me on pause as much as you need to.
Which statement best describes the concept of privacy?
The right of an individual to control
their personal information;
The right of an individual to be compensated
for the use of personal information;
The right of an individual to know
how personal information is being secured;
And the right of an individual to demand disclosure.
These are all pretty valid statements, right?
But which one of them best describes the concept of privacy?
Go ahead and put me on pause
if you need to.
All right, I'm gonna choose the first one,
which is "The right of the individual
to control their personal information."
An inherent of that, right, is really
the right to know how their personal information
might be secured and demand to know
that they have personal information,
but the succinct description of privacy
is the right of an individual to control
their personal information.
Do you agree?
I hope so.
Let's check it out and it's correct.
Okay, which response is often a consequence
of noncompliance?
Go ahead and choose all that apply.
Fines,
license revocation,
sanctions,
or loss of stakeholder trust.
Choose all that apply.
What do you think?
This is a consequence of non-compliance.
Well, fines I'm gonna choose.
License revocation or charter revocation,
that absolutely could happen.
Sanctions, definitely could happen.
And for sure, loss of stakeholder trust.
So all of these,
fines, license revocation,
sanctions, and loss of stakeholder trust
are all consequences of noncompliance.
Agree?
Well, let's check.
And that is correct.
Number three: This privacy enhancing technique
can be used to sanitize data
in such a way that it cannot be related back
to a given individual.
Is it scrubbing,
anonymization,
masking,
Or data minimization?
So we're gonna sanitize data in a way
that it can never be related back to the given individual.
What do you like?
Well, I'm gonna choose anonymization.
Anonymization, once I've anonymized data
I cannot relate it back to the original,
to the given individual.
Agree?
Let's check.
And that is correct.
All right, number four.
This OECD Privacy Principle states that
"personal data should not be disclosed, made available,
or otherwise used for purposes
other than those specified."
Is this individual participatioN,
use limitation,
data quality,
or collection limitation?
When we looked at the first five
of the OECD Privacy Principles.
This one says "personal data should not be disclosed,
made available, or otherwise used for purposes
other than those specified."
What are you gonna choose?
Put me on pause if you need to think about it.
This one is gonna be, use limitation.
Use limitation says personal data
should not be disclosed, made available,
or otherwise used for purposes
other than those specified.
Let's double check.
And that is correct.
All right, our last question, question five.
Per GDPR, this role is responsible for determining
the purposes for which, and the means by which,
personal data is processed.
Is this the data processor,
the data controller,
the data protection officer,
or the data security officer?
This is a coordinated GDPR, right?
This is the role that's responsible for determining
the purposes for which, and the means by which,
personal data is gonna be processed.
Is this our data processor,
our data controller,
our data protection officer, known as a DPO,
or our data security officer?
What do you think it's gonna be?
It's gonna be the one that's in control of the data.
That is going to be our data controller.
Our data controller is responsible for determining
the purposes for which, and the means by which,
personal data is processed.
Who actually processes the data?
Well, that's our data processor.
And who oversees all of this?
That's our DPO, our data protection officer.
Agree?
Let's check.
And that's correct.
So congratulations, great job.
Five questions, I bet you nailed them all.
Awesome!
All right, so what's up next?
Lesson 27, we're gonna explain types and purposes
of audits and assessments.
I'll see you there.