COMPREHENSIVE PRACTICE EXAM
FOR CIPP/US CERTIFICATION
PREPARATION. EXAM QUESTIONS AND
ANSWERS 100% PASS.
How does the Fair and Accurate Credit Transactions Act of 2003 (FACTA) strengthen the Fair
Credit Reporting Act (FCRA)? - ANS It introduces provisions that deal directly with identity
theft.
What is an important step in data flow mapping for regulatory compliance? - ANS Identify
custodians who are responsible for the data.
Why is the medical information provided to Medical Quizzes not protected by HIPAA? -
ANS Because the app is not provided by a covered entity.
Is a U.S.-based website collecting IP addresses considered personal data under U.S. law? -
ANS It depends on whether the website can link the IP address to other identifying
information about the visitor.
Which state's biometric law imposes penalties for violations? - ANS The Illinois Biometric
Information Privacy Act (BIPA).
What is a layered privacy notice? - ANS A short privacy notice with key points at the top.
Which telecommunications carriers are NOT subject to the U.S. Communications Assistance to
Law Enforcement Act of 1994 (CALEA)? - ANS Search engine platforms.
2026 STUDY MATERIAL @COPYRIGHT RESERVED 1
,What is broadband internet? - ANS A high-speed internet connection.
What are search engine platforms? - ANS Websites that allow users to search for information
on the internet.
What is voice-over-internet-protocol? - ANS A technology that allows voice communication
over the internet.
What should the privacy officer consider first regarding a new state privacy law? - ANS Who
enforces the law?
On what basis should data be classified for accountability? - ANS Sensitivity.
What must the School provide John regarding his grade appeal? - ANS Copies of the
communications between the nurse and school officials.
Can the School provide information about John to the Hospital without his consent? -
ANS Yes, if it relates to the health and safety of its patients.
What must John demonstrate to win his FERPA hearing? - ANS The School failed to respond
to his request for access to his educational records within 45 days.
What does the California Consumer Privacy Act require if a consumer does not allow the sale of
their personal information? - ANS Administer the same level of quality in goods and services
to the consumer.
Which is NOT a branch of the U.S. government? - ANS Administrative.
What mechanism was invalidated by the 'Schrems II' decision? - ANS EU-U.S. Privacy Shield.
2026 STUDY MATERIAL @COPYRIGHT RESERVED 2
, What is the purpose of a protective order from the court regarding personal information? -
ANS To prevent the disclosure of personal information revealed during discovery which is
irrelevant to the case.
What is the purpose of preventing a jury from considering personal information disclosed by a
witness during cross-examination? - ANS To protect the privacy of the witness.
What is the purpose of preventing attorneys from discussing personal information about their
clients during negotiations? - ANS To maintain client confidentiality.
What is the purpose of preventing litigants from sharing personal information directly with one
another without the court's permission? - ANS To uphold privacy protections in legal
proceedings.
Which of the following is NOT an example of one of the three common law torts relevant to
employee privacy? - ANS Infliction of emotional distress.
What is a Federal Trade Commission (FTC) consent decree? - ANS A decree in which the
respondent does not admit fault but will change its practices and avoid further litigation.
Under the Video Privacy Protection Act (VPPA), what is an exception to the prohibition against
sharing customer personal information with third parties? - ANS The provider shares the
information for order fulfillment, request processing, transfer of ownership or debt collection.
Which Regulatory Authority would have made enforcement against Tech Gurus? -
ANS Federal Trade Commission (FTC).
What type of settlement agreement was reached between Tech Gurus and the regulatory
agency? - ANS Consent decree.
The settlement was reached between Tech Gurus and the regulatory agency. The regulatory
agency is from which branch of the government? - ANS Executive Branch.
2026 STUDY MATERIAL @COPYRIGHT RESERVED 3
FOR CIPP/US CERTIFICATION
PREPARATION. EXAM QUESTIONS AND
ANSWERS 100% PASS.
How does the Fair and Accurate Credit Transactions Act of 2003 (FACTA) strengthen the Fair
Credit Reporting Act (FCRA)? - ANS It introduces provisions that deal directly with identity
theft.
What is an important step in data flow mapping for regulatory compliance? - ANS Identify
custodians who are responsible for the data.
Why is the medical information provided to Medical Quizzes not protected by HIPAA? -
ANS Because the app is not provided by a covered entity.
Is a U.S.-based website collecting IP addresses considered personal data under U.S. law? -
ANS It depends on whether the website can link the IP address to other identifying
information about the visitor.
Which state's biometric law imposes penalties for violations? - ANS The Illinois Biometric
Information Privacy Act (BIPA).
What is a layered privacy notice? - ANS A short privacy notice with key points at the top.
Which telecommunications carriers are NOT subject to the U.S. Communications Assistance to
Law Enforcement Act of 1994 (CALEA)? - ANS Search engine platforms.
2026 STUDY MATERIAL @COPYRIGHT RESERVED 1
,What is broadband internet? - ANS A high-speed internet connection.
What are search engine platforms? - ANS Websites that allow users to search for information
on the internet.
What is voice-over-internet-protocol? - ANS A technology that allows voice communication
over the internet.
What should the privacy officer consider first regarding a new state privacy law? - ANS Who
enforces the law?
On what basis should data be classified for accountability? - ANS Sensitivity.
What must the School provide John regarding his grade appeal? - ANS Copies of the
communications between the nurse and school officials.
Can the School provide information about John to the Hospital without his consent? -
ANS Yes, if it relates to the health and safety of its patients.
What must John demonstrate to win his FERPA hearing? - ANS The School failed to respond
to his request for access to his educational records within 45 days.
What does the California Consumer Privacy Act require if a consumer does not allow the sale of
their personal information? - ANS Administer the same level of quality in goods and services
to the consumer.
Which is NOT a branch of the U.S. government? - ANS Administrative.
What mechanism was invalidated by the 'Schrems II' decision? - ANS EU-U.S. Privacy Shield.
2026 STUDY MATERIAL @COPYRIGHT RESERVED 2
, What is the purpose of a protective order from the court regarding personal information? -
ANS To prevent the disclosure of personal information revealed during discovery which is
irrelevant to the case.
What is the purpose of preventing a jury from considering personal information disclosed by a
witness during cross-examination? - ANS To protect the privacy of the witness.
What is the purpose of preventing attorneys from discussing personal information about their
clients during negotiations? - ANS To maintain client confidentiality.
What is the purpose of preventing litigants from sharing personal information directly with one
another without the court's permission? - ANS To uphold privacy protections in legal
proceedings.
Which of the following is NOT an example of one of the three common law torts relevant to
employee privacy? - ANS Infliction of emotional distress.
What is a Federal Trade Commission (FTC) consent decree? - ANS A decree in which the
respondent does not admit fault but will change its practices and avoid further litigation.
Under the Video Privacy Protection Act (VPPA), what is an exception to the prohibition against
sharing customer personal information with third parties? - ANS The provider shares the
information for order fulfillment, request processing, transfer of ownership or debt collection.
Which Regulatory Authority would have made enforcement against Tech Gurus? -
ANS Federal Trade Commission (FTC).
What type of settlement agreement was reached between Tech Gurus and the regulatory
agency? - ANS Consent decree.
The settlement was reached between Tech Gurus and the regulatory agency. The regulatory
agency is from which branch of the government? - ANS Executive Branch.
2026 STUDY MATERIAL @COPYRIGHT RESERVED 3
