Introduction to the U.S. Privacy Environment

Structure of U.S. law, enforcement of privacy and security laws, and information management practices from a U.S. perspective.

5 minutes 5 Questions

The U.S. privacy environment is a complex, multifaceted landscape shaped by a combination of constitutional principles, federal and state laws, regulations, and industry self-regulation. Unlike the European Union, which adopts a comprehensive, omnibus approach to privacy through frameworks like the…

Concepts covered
Branches of Government and Sources of U.S. LawFederal Regulatory Authorities (FTC, FCC, DoC, HHS)Self-Regulatory Programs and Trust MarksGeneral Theories of Legal Liability (Contract, Tort, Civil Enforcement)Federal and State Enforcement ActionsManaging User Preferences and ConsentIncident Response Programs and Cyber ThreatsWorkforce Training and AccountabilityData Retention and Disposal (FACTA)Online Privacy and Privacy NoticesVendor Management and Third-Party Data SharingInternational Data Transfers (Privacy Shield, BCRs, SCCs)GDPR and APEC Requirements for U.S. MultinationalsResolving Multinational Compliance ConflictsLegal Definitions: Jurisdiction, Preemption, and Private Right of ActionBanking Regulators and State Attorneys GeneralCriminal vs. Civil Liability in Privacy LawNegligence and Unfair and Deceptive Trade PracticesCross-Border Enforcement and GPENData Inventory, Classification, and Flow MappingPrivacy Program Development
Test mode:
Start practice test

CIPP/US - Introduction to the U.S. Privacy Environment Example Questions

Test your knowledge of Introduction to the U.S. Privacy Environment

Question 1

When evaluating the completeness of a data inventory process, which criterion provides the most accurate measure of its effectiveness?

Correct Answer: The inclusion of all information lifecycle phases from initial collection to final disposal.

The inclusion of all information lifecycle phases ensures a comprehensive map of what data exists, where it resides, and how it flows through the organization from creation to destruction.
Tracking employee system access logs is an access control measure rather than a data inventory element. Aligning data structures with hardware upgrades focuses on IT infrastructure rather than data mapping. Integrating vendor service level agreements into a dashboard relates to vendor management and security monitoring rather than the actual inventory of personal data.
The key concept tested is the scope and objective of comprehensive data inventory and mapping processes.

Question 2

A company uses a vendor to process employee health screening data. The vendor's contract includes data protection terms, but the company has never verified whether the vendor actually follows those terms. A new privacy analyst asks what ongoing obligation the company has regarding this vendor relationship. Which of the following best describes this obligation?

Correct Answer: Conducting periodic assessments to confirm the vendor's compliance with contractual data protection commitments

Conducting periodic assessments or audits of vendor compliance with contractual data protection commitments is a recognized best practice and ongoing obligation under U.S. privacy frameworks, particularly when sensitive data like employee health screening information is involved.

Requiring annual self-certification alone is insufficient because it relies entirely on the vendor's own representations without independent verification. Maintaining a publicly accessible privacy policy is unrelated to the obligation of vendor oversight and contract enforcement. Annually updating the contract for new standards is a good practice but does not address the core obligation of verifying actual compliance with existing terms.

The key concept tested is vendor management and ongoing third-party oversight obligations in privacy programs.

Question 3

A landlord pulls consumer credit reports to screen prospective tenants. After a tenant signs a lease, the landlord stores the printed credit reports in an unlocked filing cabinet in a shared office. When asked about disposal, the landlord says the reports will be shredded once the tenant moves out. Which statement best describes the landlord's obligation under FACTA's Disposal Rule?

Correct Answer: The landlord must take reasonable measures to protect against unauthorized access to the reports during the entire retention period, then properly dispose of them

FACTA's Disposal Rule requires that any person who maintains or possesses consumer report information for a business purpose must take reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal, but this obligation is understood in the broader context of safeguarding consumer information throughout its lifecycle, including during retention, not just at the moment of destruction.

The plan to shred upon move-out does not address the current unsafe storage in an unlocked cabinet, which itself creates unauthorized access risk. FACTA does not limit obligations solely to the moment of discarding; reasonable protective measures apply during the entire period information is held. There is no requirement to return reports to the credit reporting agency. The key concept tested is FACTA Disposal Rule obligations extending to reasonable safeguarding of consumer report information throughout retention, not merely at the point of disposal.

More Introduction to the U.S. Privacy Environment questions
564 questions (total)
Practice 100 questions
One session at a time, always new questions