Free Certified Information Privacy Professional / United States (CIPP/US) practice test: 30 questions with answers

The United States generally takes a sectoral approach, with targeted federal laws for specific industries and data types, supplemented by state laws and FTC consumer protection enforcement. A single comprehensive federal statute, a national registration regime, and direct treaty binding of private companies do not describe the U.S. model.

Under the Supremacy Clause, valid federal law can displace conflicting state law, either through express preemption language or through conflict with federal requirements. Stare decisis, sovereign immunity, and equal protection do not resolve a conflict between a federal statute and a state statute.

The notice or awareness principle requires organizations to disclose what they collect, how they use it, and who receives it, typically through a privacy notice. Choice concerns consent or opt-out, participation concerns access and correction, and integrity and security concern accuracy and safeguards.

A material misrepresentation in a privacy policy about how data is shared can be a deceptive practice under Section 5 of the FTC Act, even when a vendor's code performs the transfer. Deception does not require proof of a specific financial loss, which is one way it differs from unfairness.

The Fourth Amendment limits government searches and seizures, not conduct by private companies acting on their own. A private retailer's data practices are generally governed by statutes, contracts, and consumer protection law instead.

FERPA is administered and enforced by the U.S. Department of Education, which can investigate complaints and withhold federal funds from noncompliant institutions. The FTC, the HHS Office for Civil Rights, and the FCC enforce other statutes, namely the FTC Act, HIPAA, and telecommunications rules.

The Privacy Rule generally requires an individual's authorization for uses and disclosures of PHI for marketing, and where the covered entity receives financial remuneration from a third party for the communication, the authorization must state that. Marketing is not a routine operation, OCR does not pre-approve communications, and treatment-related communications for which no third-party payment is received fall under different exceptions.

Section 5(n) of the FTC Act defines unfairness as practices that cause or are likely to cause substantial injury that consumers cannot reasonably avoid and that is not outweighed by countervailing benefits. Intent to deceive, a written notice, and an opt-in are not elements of unfairness.

COPPA requires operators that collect personal information from children under 13, including those with actual knowledge that a user is under 13, to obtain verifiable parental consent first. The child's own agreement, a home-page notice alone, or later deletion does not satisfy the rule.

A covered entity must have satisfactory assurances, typically a business associate agreement, before a business associate handles PHI on its behalf. Patient authorizations are not generally needed for routine payment activities, the FTC does not certify HIPAA compliance, and joint controller agreements are a GDPR concept.

The GLBA Financial Privacy Rule generally requires a privacy notice and an opt-out opportunity before sharing nonpublic personal information with nonaffiliated third parties, subject to exceptions such as service providers. Opt-in consent, advance CFPB registration, and FTC-approved audits are not the general requirement.

The FCRA requires an employer that may take adverse action based on a consumer report to first send a pre-adverse action notice, with a copy of the report and a summary of rights, so the applicant can respond. Filing with the FTC, immediate deletion, and a dispute waiver are not FCRA requirements.

In Carpenter, the Court held that acquiring historical cell-site location records generally requires a warrant supported by probable cause, because the records reveal an intimate picture of a person's movements. Subpoenas, National Security Letters, and consent through terms of service do not meet that standard for this type of data.

Real-time interception of communication content falls under the Wiretap Act, Title III, which generally requires a court order grounded in probable cause and other statutory findings. The pen register statute covers only non-content dialing and routing data, the SCA governs stored communications rather than live calls, and CALEA requires carriers to build interception capability without authorizing any interception itself.

The USA FREEDOM Act ended bulk collection of telephone metadata under Section 215, and the FBI can issue National Security Letters in national security investigations without a court order. The CLOUD Act reaches data within a provider's control regardless of where it is stored, Section 702 targets non-U.S. persons reasonably believed to be located abroad, and the Wiretap Act does not allow interception based on an officer's belief alone.

Federal Rule of Civil Procedure 26(b)(1) limits discovery to nonprivileged matter that is relevant to a claim or defense and proportional to the needs of the case, and Rule 26(c) allows protective orders for privacy concerns. Employers do have privacy interests that courts weigh, pre-approval by a judge is not required, and discovery is not limited to filed documents.

The third-party doctrine, applied in Miller and Smith, holds that people generally have no reasonable expectation of privacy in information voluntarily given to a third party such as a bank or phone company, although Carpenter narrowed it for cell-site records. The good-faith exception, plain view, and fruit of the poisonous tree doctrines govern whether evidence can be used, not whether a shared record is protected.

Once litigation is reasonably anticipated, the company has a duty to preserve relevant electronically stored information, and a litigation hold suspends routine deletion. Waiting for a court order, deleting selected messages, or moving them to personal accounts risks spoliation sanctions.

Ban-the-box laws limit when and how employers may ask about criminal history, often barring the question on initial applications. Submitting a form does not override a statutory prohibition, and federal law does not generally require applicants to disclose all prior convictions to private employers.

The EPPA generally prohibits most private employers from requiring or requesting polygraph tests of applicants or employees, with narrow exceptions for certain security and pharmaceutical settings. HIPAA, COPPA, and the VPPA address health records, children's online data, and video rental records, not general workplace polygraph use.

GINA prohibits employers from using genetic information, which includes family medical history, in employment decisions and restricts how employers acquire it. The FCRA, FERPA, and TCPA address consumer reports, education records, and telephone calls, so none of them governs this particular use.

Several states require notice of electronic monitoring, and Section 7 of the NLRA protects concerted activity in union and non-union workplaces, so monitoring that chills that activity creates risk. The ECPA does not prohibit all monitoring, federal law does not require written consent for common-area video, and paying for internet access does not authorize review of personal social media.

Many states prohibit employers from requiring applicants or employees to disclose login credentials for personal accounts, and a legitimate business interest does not override that restriction. The FCRA applies to reports from consumer reporting agencies, not automatically to an employer's own review of posts, and a rejection letter does not cure the request.

The ADA requires employers to keep medical information about employees confidential, in separate medical files apart from general personnel records, with access limited to appropriate personnel. Storing the results in the general personnel file, on a shared intranet, or in performance reviews would violate that confidentiality requirement.

The CCPA gives consumers a right to request deletion, and businesses must delete covered personal information unless a statutory exception applies, and must also direct service providers and contractors to delete it. The other options invent a 24-hour deadline, a fee requirement, and a purchase-based denial that the statute does not impose.

Virginia's Consumer Data Protection Act is enforced by the state attorney general, and it does not give consumers a direct lawsuit. The FTC is not the sole enforcer of state privacy statutes, consumers do not have to file with a federal agency first, and fixed per-violation damages are not part of this statute.

All 50 states and the District of Columbia have breach notification statutes, and many exempt encrypted data when the key was not also acquired. The laws are not uniform in content or deadlines, data stored on a company's own servers can still trigger notice, and no comprehensive federal statute preempts state breach laws for most non-HIPAA entities.

BIPA requires a publicly available written retention policy and informed written consent before collecting biometric identifiers such as fingerprints, and it gives affected individuals a private right of action with liquidated damages. Attorney general-only enforcement, a sale-only trigger, and a timekeeping exclusion do not match the statute's structure.

Local Law 144 requires an independent bias audit of an automated employment decision tool before use, a publicly available summary of the audit results, and notice to candidates. It does not require state registration, a country-of-origin certification, or each candidate's written approval.

The CPRA added a right to correct inaccurate personal information, which businesses must address in response to a verifiable consumer request, subject to statutory exceptions. The statute does not require a permanent halt to collection, payments for errors, or publication of internal correction logs.