Course outline
Module 1
Module 1: Foundations of Privacy Rights
Foundations of Privacy Rights
Knowledge check
Q1. Which 1890 article by Samuel Warren and Louis Brandeis is widely regarded as the foundational work on the right to privacy in American law?
- A. The Right to Be Forgotten
- B. The Right to Privacy ✓
- C. Privacy in the Digital Commons
- D. Property and the Public Interest
Why: Warren and Brandeis's 1890 Harvard Law Review article 'The Right to Privacy' argued that common law should recognize a right to be left alone, and it became the foundation for later privacy doctrine.
Q2. Which term describes the principle that individuals should be able to control how their personal information is collected, used, and shared?
- A. Informational self-determination ✓
- B. Data minimization
- C. Algorithmic transparency
- D. Vicarious consent
Why: Informational self-determination, associated with the German Federal Constitutional Court's 1983 census decision, holds that individuals should decide for themselves when and how their personal data is disclosed and used.
Q3. Which of the following is generally considered the core idea behind the Fair Information Practice Principles (FIPPs)?
- A. Organizations may collect any data they can store indefinitely
- B. Individuals should have notice, choice, access, and security regarding their personal information ✓
- C. Governments must publish all citizen data publicly
- D. Privacy only matters for financial records
Why: The FIPPs, developed in the United States in the 1970s and later adopted internationally, center on notice, choice, access, integrity, and accountability for personal data handling.
Q4. What is 'personal data' under the EU General Data Protection Regulation (GDPR)?
- A. Only data stored on personal devices
- B. Only sensitive data such as health or religious information
- C. Any information relating to an identified or identifiable natural person ✓
- D. Only data a person has explicitly published online
Why: Article 4 of the GDPR defines personal data broadly as any information relating to an identified or identifiable natural person, which includes indirect identifiers such as location or online identifiers.
Q5. Which concept refers to a person's reasonable expectation of being free from intrusion in private settings, a standard often used in U.S. Fourth Amendment analysis?
- A. Reasonable expectation of privacy ✓
- B. Duty of care
- C. Public domain doctrine
- D. Strict liability
Why: The 'reasonable expectation of privacy' test, articulated in Justice Harlan's concurrence in Katz v. United States (1967), determines whether government intrusion constitutes a search under the Fourth Amendment.
Module 2
Module 2: Data Protection Frameworks
Data Protection Frameworks
Knowledge check
Q1. Which regulation is the primary data protection law of the European Union, applying from May 2018?
- A. The California Consumer Privacy Act (CCPA)
- B. The General Data Protection Regulation (GDPR) ✓
- C. The Data Protection Act 1998
- D. The Privacy Shield Framework
Why: The GDPR, which took effect on 25 May 2018, is the EU's comprehensive data protection regulation. It applies directly across member states and also reaches organizations outside the EU that process data of people in the EU.
Q2. Under the GDPR, which of the following is one of the recognized lawful bases for processing personal data?
- A. The organization's desire to increase profits
- B. The data subject's consent ✓
- C. The data being publicly visible online
- D. The data being older than five years
Why: Article 6 of the GDPR lists six lawful bases, including consent, contract performance, legal obligation, vital interests, public task, and legitimate interests. Commercial benefit alone and public visibility are not sufficient on their own.
Q3. What does the principle of 'data minimisation' require?
- A. Organizations must store data in the smallest possible physical servers
- B. Personal data collected should be adequate, relevant, and limited to what is necessary for the purpose ✓
- C. Data must be deleted after exactly one year
- D. Only government agencies may collect personal data
Why: Data minimisation is a core GDPR principle under Article 5(1)(c). It means organizations should collect and retain only the personal data genuinely needed to achieve the stated purpose.
Q4. Which body in the EU is responsible for ensuring consistent application of the GDPR across member states?
- A. The European Court of Human Rights
- B. The European Data Protection Board (EDPB) ✓
- C. The European Central Bank
- D. The Council of Europe
Why: The European Data Protection Board is an independent EU body composed of national supervisory authorities and the European Data Protection Supervisor. It promotes consistent application of the GDPR and issues guidelines and binding decisions in cross-border disputes.
Q5. Under the GDPR, what is a 'data subject'?
- A. A company that processes personal data
- B. A government official who regulates data
- C. An identified or identifiable natural person whose personal data is processed ✓
- D. Any computer system that stores information
Why: Article 4 of the GDPR defines a data subject as an identified or identifiable living individual to whom personal data relates. Companies and systems are not data subjects; the rights under the GDPR belong to individuals.
Module 3
Module 3: Consent and User Control
Consent and User Control
Knowledge check
Q1. Under the GDPR, which of the following is a valid requirement for consent to be considered freely given?
- A. Consent is bundled into the general terms of service so users accept everything at once
- B. Users can refuse or withdraw consent without suffering detriment such as losing access to an unrelated service ✓
- C. Consent is assumed when a user continues to browse a website after seeing a notice
- D. Consent is obtained through pre-ticked checkboxes that users can uncheck if they notice them
Why: The GDPR requires consent to be freely given, meaning users must be able to refuse or withdraw it without detriment. Bundled consent, assumed consent from continued browsing, and pre-ticked boxes do not meet this standard.
Q2. What does the 'right to withdraw consent' allow an individual to do?
- A. Demand that all data collected before the withdrawal be deleted immediately with no exceptions
- B. Stop future processing of their personal data based on consent, with withdrawal as easy as giving consent ✓
- C. Require the organization to pay compensation for any data processed while consent was active
- D. Transfer their consent permanently to a third party without notifying the original organization
Why: Withdrawing consent stops future processing based on that consent, and under the GDPR it must be as easy to withdraw as it was to give. It does not automatically erase past lawful processing or require compensation.
Q3. Which of the following best describes 'informed consent' in data privacy law?
- A. Consent given after the user has read a lengthy privacy policy of any length
- B. Consent given by a user who has been told what data is collected, why, and who it will be shared with ✓
- C. Consent given by a company's legal department on behalf of all its users
- D. Consent given verbally during a phone call with customer service
Why: Informed consent requires that the individual understand what data is collected, the purpose, and who receives it. A long policy that users never read, or consent given by someone other than the data subject, does not meet this standard.
Q4. Under the GDPR, which legal basis for processing personal data is an alternative to obtaining consent?
- A. Legitimate interests of the controller, balanced against the rights of the data subject ✓
- B. The company's desire to increase advertising revenue
- C. The fact that the data is already publicly available on the internet
- D. The user's failure to opt out within 30 days of notification
Why: The GDPR lists six lawful bases, including legitimate interests, which allow processing without consent when the controller's interests are balanced against the data subject's rights. Commercial gain alone, public availability, or silence are not valid bases on their own.
Q5. Which practice is most consistent with giving users meaningful control over their data?
- A. Providing a privacy dashboard where users can view, download, and delete their data and adjust consent settings ✓
- B. Hiding opt-out options within a deeply nested settings menu to reduce user changes
- C. Renewing consent automatically every time a user logs in to avoid repeated prompts
- D. Collecting data first and asking for permission only if a user complains
Why: A privacy dashboard giving access, portability, deletion, and consent controls directly supports user control. Hidden opt-outs, automatic renewal, and collecting first all undermine meaningful choice.
Module 4
Module 4: Surveillance and Government Access
Surveillance and Government Access
Knowledge check
Q1. Which U.S. constitutional amendment is most commonly cited as the basis for protection against unreasonable government searches and seizures?
- A. First Amendment
- B. Fourth Amendment ✓
- C. Fifth Amendment
- D. Fourteenth Amendment
Why: The Fourth Amendment protects people from unreasonable searches and seizures and generally requires a warrant supported by probable cause. It is the primary constitutional foundation for surveillance limits in the United States.
Q2. In the U.S. case Katz v. United States (1967), what test did the Supreme Court establish to determine whether a search occurred under the Fourth Amendment?
- A. The strict scrutiny test
- B. The reasonable expectation of privacy test ✓
- C. The clear and present danger test
- D. The public records doctrine
Why: Katz held that the Fourth Amendment protects people, not just places, and introduced the two-part reasonable expectation of privacy test: whether a person has a subjective expectation of privacy and whether society recognizes that expectation as reasonable.
Q3. What does the third-party doctrine generally hold?
- A. Individuals always retain full privacy over data shared with companies
- B. Information voluntarily shared with a third party may lose Fourth Amendment protection ✓
- C. Government agencies must always obtain a warrant before accessing any records
- D. Third parties are prohibited from storing personal data
Why: Under the third-party doctrine, as seen in cases like Smith v. Maryland and United States v. Miller, people who voluntarily share information with others, such as phone companies or banks, may have no reasonable expectation of privacy in that information.
Q4. Which law, enacted in 1986, sets rules for government access to stored electronic communications and subscriber records held by service providers?
- A. The Privacy Act of 1974
- B. The Foreign Intelligence Surveillance Act of 1978
- C. The Electronic Communications Privacy Act (ECPA) ✓
- D. The USA PATRIOT Act of 2001
Why: The Electronic Communications Privacy Act of 1986 includes the Stored Communications Act, which governs how law enforcement can compel disclosure of electronic communications and records from providers, using tools such as warrants, court orders, and subpoenas with different protection levels.
Q5. What is a key feature of a search warrant under the Fourth Amendment?
- A. It can be issued by any government official without judicial review
- B. It must be supported by probable cause and describe the place to be searched and items to be seized ✓
- C. It allows unlimited searches once issued
- D. It requires the target's consent before execution
Why: A valid warrant must be issued by a neutral magistrate, be supported by probable cause, and particularly describe the places to be searched and the things to be seized. These requirements limit the scope of government intrusion.
Module 5
Module 5: Online Tracking and Advertising
Online Tracking and Advertising
Knowledge check
Q1. What is a third-party cookie?
- A. A cookie set by the website the user is directly visiting
- B. A cookie set by a domain different from the one the user is visiting, often used for cross-site tracking ✓
- C. A cookie that stores a user's login password in encrypted form
- D. A cookie that expires after one browser session ends
Why: Third-party cookies are set by domains other than the site being visited, typically advertising or analytics companies, allowing them to recognize a user across many different websites.
Q2. What does the term 'fingerprinting' refer to in online tracking?
- A. Scanning a user's fingerprint through a device's touchscreen
- B. Identifying a user by combining device and browser attributes such as screen resolution, fonts, and installed plugins ✓
- C. Verifying a user's identity with a biometric password
- D. Encrypting browsing history so only the user can read it
Why: Browser fingerprinting builds a near-unique identifier from configuration details of a device and browser, allowing tracking even when cookies are deleted or blocked.
Q3. Which legal principle is most directly associated with requiring a website to tell users about tracking and obtain their consent before setting non-essential cookies in the EU?
- A. The ePrivacy Directive (as implemented through national cookie laws) ✓
- B. The Sherman Antitrust Act
- C. The Fair Credit Reporting Act
- D. The Children's Online Privacy Protection Act
Why: The EU ePrivacy Directive, implemented nationally, requires informed consent for storing or accessing information on users' devices, including non-essential cookies used for tracking.
Q4. What is the main purpose of an opt-out mechanism in online advertising?
- A. To let users choose not to have their personal data used for certain targeted advertising ✓
- B. To automatically increase the number of ads a user sees
- C. To permanently delete all of a user's accounts
- D. To require users to pay for an ad-free experience
Why: An opt-out mechanism lets individuals decline the collection or use of their data for targeted advertising, giving them control over behavioral profiling.
Q5. Why do 'Do Not Track' signals have limited practical effect today?
- A. Browsers no longer support sending any privacy-related headers
- B. Websites are legally required to ignore them in every jurisdiction
- C. Compliance is voluntary for websites, so many do not honor the signal ✓
- D. They only apply to mobile apps and not to web browsers
Why: Do Not Track is a browser header that websites are not uniformly obligated to honor in most jurisdictions, so compliance has been inconsistent and largely voluntary.
Module 6
Module 6: Data Breaches and Liability
Data Breaches and Liability
Knowledge check
Q1. What is generally considered a 'data breach' under privacy law?
- A. Any scheduled update to a company's database
- B. An unauthorized access to, or disclosure or loss of, personal data ✓
- C. A customer voluntarily deleting their own account
- D. A company changing its privacy policy wording
Why: A data breach involves unauthorized access, acquisition, disclosure, or loss of personal information. Routine updates or voluntary customer actions do not qualify.
Q2. Which regulation requires organizations to notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it, where feasible?
- A. The California Consumer Privacy Act (CCPA)
- B. The Health Insurance Portability and Accountability Act (HIPAA) only
- C. The General Data Protection Regulation (GDPR) ✓
- D. The Children's Online Privacy Protection Act (COPPA)
Why: Article 33 of the GDPR requires controllers to notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to individuals.
Q3. In the context of data breach liability, what does 'negligence' typically require a plaintiff to show?
- A. That the company intentionally stole the data
- B. That the company had a duty of care, breached it, and caused harm as a result ✓
- C. That the company posted the data publicly on purpose
- D. That the company is located outside the plaintiff's country
Why: Negligence claims generally require proving duty, breach of that duty, causation, and damages. Intent to steal is not required for negligence.
Q4. Which of the following is an example of personal data that often triggers breach notification obligations?
- A. A company's annual revenue figures
- B. A publicly listed store address
- C. A customer's Social Security number combined with their name ✓
- D. The weather forecast for a region
Why: Combinations like a name plus a Social Security number, financial account details, or health information are classic triggers for breach notification laws in many U.S. states and other jurisdictions.
Q5. What is a common purpose of encrypting personal data in relation to breach liability?
- A. It guarantees the data can never be stolen
- B. It can reduce notification obligations if the stolen data is rendered unreadable ✓
- C. It eliminates the need for a privacy policy
- D. It automatically transfers liability to the customer
Why: Many breach notification laws provide safe harbors where encrypted data is compromised without the encryption key, since the data is unlikely to be usable. Encryption does not guarantee prevention of theft, however.
Module 7
Module 7: Emerging Technologies and Future Regulation
Emerging Technologies and Future Regulation
Knowledge check
Q1. Which principle of the EU General Data Protection Regulation (GDPR) requires that personal data be used only for specified, explicit, and legitimate purposes?
- A. Data minimisation
- B. Purpose limitation ✓
- C. Storage limitation
- D. Accountability
Why: Purpose limitation (Article 5(1)(b) GDPR) means personal data collected for one purpose cannot generally be processed in ways incompatible with that original purpose. Data minimisation concerns collecting only what is necessary, storage limitation concerns how long data is kept, and accountability concerns the controller's duty to demonstrate compliance.
Q2. What does the term 'algorithmic transparency' most commonly refer to in discussions of future privacy regulation?
- A. Publishing the source code of every website
- B. Making it possible to understand and explain how automated systems reach decisions that affect individuals ✓
- C. Encrypting all data stored by an algorithm
- D. Removing all personal data from training datasets
Why: Algorithmic transparency refers to the ability to understand, explain, and audit how automated systems make decisions, especially decisions affecting people's rights, credit, employment, or access to services. It does not require publishing all code or simply encrypting data.
Q3. Under the GDPR, which right allows individuals to object to decisions based solely on automated processing that produce legal or similarly significant effects?
- A. Right to rectification
- B. Right to data portability
- C. Right not to be subject to solely automated decision-making ✓
- D. Right to restriction of processing
Why: Article 22 GDPR gives individuals the right not to be subject to decisions based solely on automated processing, including profiling, where those decisions have legal or similarly significant effects, subject to certain exceptions with safeguards.
Q4. What is the main privacy concern raised by Internet of Things (IoT) devices such as smart speakers and connected thermostats?
- A. They always require a physical wired connection
- B. They continuously collect data about people's behaviour and surroundings, often without users fully understanding the scope ✓
- C. They can only be used by businesses, not households
- D. They store data exclusively on local hardware with no network transmission
Why: IoT devices often gather continuous streams of data about daily routines, voices, and environments, frequently transmitting it to cloud services. Users may not be aware of the volume or who can access it, which creates significant privacy risks.
Q5. What is the purpose of a Data Protection Impact Assessment (DPIA) under the GDPR?
- A. To calculate the financial value of a company's data assets
- B. To identify and minimise data protection risks before starting high-risk processing activities ✓
- C. To certify that a company is compliant with all national laws
- D. To transfer personal data to third countries without safeguards
Why: A DPIA, required under Article 35 GDPR for processing likely to result in high risk to individuals' rights and freedoms, helps organisations systematically assess risks and identify measures to mitigate them before processing begins, such as with new technologies.