Free CIPP-US flashcards

In an M&A stock purchase agreement, what drafting choice in the privacy representations best shifts privacy risk from buyer to seller?

A broad representation that the target has at all times complied with all applicable privacy laws and its own published commitments, qualified only by a disclosure schedule of known exceptions. Backed by an indemnity, it forces the seller to surface known issues and leaves the seller liable for undisclosed non-compliance.

A representation that the buyer has independently satisfied itself and waives reliance on any seller data-handling statement allocates risk to the seller.

This sounds rigorous and confuses buyer diligence with risk allocation, but it actually waives the buyer's recourse. The effect is to shift privacy risk onto the buyer rather than the seller, the opposite of the goal.

What statutory power lets the FTC act against a company that misrepresented its data-sharing practices even when no sector-specific privacy statute was broken?

Section 5 of the FTC Act, which bars unfair or deceptive acts or practices. It gives the FTC general enforcement power to act on a misrepresentation even where no specific privacy statute applies.

The FTC's authority over deceptive business practices comes from a constitutional right to fair dealing implied by the Fourteenth Amendment's Due Process Clause.

Tempting because due process sounds protective, but it limits government conduct toward individuals and is not the source of FTC authority over deceptive business practices, which rests on Section 5 of the FTC Act.

Under the leading state comprehensive privacy model (Virginia, Colorado, Connecticut), what determines whether a consumer has a right to opt out of automated profiling?

The profiling opt-out is limited to profiling carried out in furtherance of decisions that produce legal or similarly significant effects on the consumer, such as credit, housing, or employment outcomes. It does not reach all automated processing, only significant-effect profiling.

Any automated processing of personal data triggers the profiling opt-out, because the right applies whenever a model processes any personal data at all.

Tempting because it sounds like the right is broad, but the opt-out is tied to profiling in furtherance of decisions with legal or similarly significant effects, not to processing generally. Treating all automated processing as a trigger overstates the scope.

How did the USA FREEDOM Act change the nondisclosure (gag) requirement attached to a National Security Letter?

It left NSL authority intact but reformed the gag provisions: recipients gained access to judicial review of the nondisclosure requirement, and the government must periodically reassess and terminate secrecy once it is no longer needed.

Once an NSL nondisclosure requirement is imposed, it is permanent and the provider has no statutory mechanism to seek its removal at any later time.

Tempting because NSL gag orders were historically open-ended, but USA FREEDOM created review and termination mechanisms, so the gag is neither permanent nor unchallengeable.