1A-3-Fair Information Practices Exam
With 100% Correct Answers 2026-2027
Update.
Fair Information Practices - Answer Fair Information Practices (FIPs), also called Fair
Information Privacy Practices (FIPPs), are a set of principles and practices that describe how best
to approach the collection, storage, and management of data with the aim of achieving and
maintaining fairness, privacy, and security with respect to that data.1 More succinctly, FIPs are
guidelines that attempt to balance privacy interests with security and fairness. FIPs are widely
used to develop laws and regulations concerning data privacy and security. The extent to which
any FIP is legally binding changes with particular circumstance, but FIPs serve as general guiding
principles for managing, storing, and handling personal information.
Below are some important examples of FIPs that have been developed in the United States and
internationally. After these examples, we discuss the common themes that emerge from the
various examples below.
i. Early Adoption of FIPs (FIPs in the United States) - Answer There are many ways to articulate
FIPs. The first official attempt to do so in the United States occurred in 1973. That year, the
Department of Health, Education, and Welfare ("DHEW"), later renamed the Department of
Health and Human Services ("HHS"), promulgated an official set of FIPs. The DHEW identified
five different practices organizations should attempt to follow:
•
"There must be no personal-data record-keeping systems whose very existence is secret."
•
"There must be a way for an individual, to find out what information about him is in a record
and how it is used."
•
"There must be a way for an individual to prevent information about him obtained for one
purpose from being used or made available for other purposes without his consent."
•
"There must be a way for an individual to correct or amend a record of identifiable information
about him."
•
"Any organization creating, maintaining, using, or disseminating records of identifiable personal
data must assure the reliability of the data for their intended use and must take reasonable
precautions to prevent misuse of the data."
The year following the adoption of these FIPs by GHEW, Congress passed the Privacy Act of
1974.The Privacy Act of 1974, as amended, codifies a set of FIPs that govern how information
about individuals in the records of federal agencies is collected, maintained, used, and
, disseminated.Each federal agency is required to adopt rules to effect the purpose of the Privacy
Act of 1974. There can be harsh penalties for any violation of these rules, including the
imposition of civil remedies or criminal prosecution.
ii. The 2012 White House Report (FIPs in the United States) - Answer More recently, in 2012,
the White House issued a report entitled Consumer Data Privacy in a Networked World: A
Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy. The
White House included in this report a "Consumer Privacy Bill of Rights," which was a set of
principles based on traditional FIPs that the White House believed should be applied to the
commercial use of personal information. Included in this Consumer Privacy Bill of Rights were
the principles of individual control, transparency, respect for context, security, access and
accuracy, focused collection of information, and accountability. Emphasizing that these are
merely principles and that there is no one-size-fits-all approach when it comes to the
application of FIPs, the White House Report stated that "[c]ontext should shape the balance and
relative emphasis of [these] particular principles."
iii. The 2012 FTC Report (FIPs in the United States) - Answer The same year that the White
House issued this report, the Federal Trade Commission ("FTC") also issued a report on
Protecting Consumer Privacy in an Era of Rapid Change (the "2012 FTC Report").That report calls
on companies to implement various recommendations for protecting privacy, and it emphasized
three main areas of concern.
First, the FTC encouraged companies to adopt a "Privacy by Design" approach to developing
new products and services in which companies "build in" privacy as part of their systems
engineering.Put differently, a "Privacy by Design" approach calls on companies to "promote
consumer privacy throughout their organizations and at every stage of the development of their
products and services." The privacy concepts that should be "built in" to products and services
include: data security, reasonable collection limits, sound data retention and disposal practices,
and data accuracy. Similarly, the 2012 FTC Report calls on companies to "maintain
comprehensive data management procedures throughout the life cycle of their products and
services."
The second privacy principle that the 2012 FTC Report encouraged companies to adopt was
simplified consumer choice regarding how personal information is used. The FTC recognized
that consumer choice is not always required or appropriate. Rather, the availability of consumer
choice should be consistent with the context of the transaction or the company's relationship
with the consumer, unless providing consumer's the ability to make meaningful choices about
how their personal information is used is mandated by specific law or regulation. Two situations
calling for express, affirmative consumer consent are when a company seeks retroactive consent
to use personal information in a manner that is materially different than the manner in which
the data was used when ori
Examples of FIPs in International Frameworks - Answer FIPs have also been adopted
internationally. Important conventions, agreements, and frameworks tested on the CIPP/US
exam include the following: (1) the "Guidelines on the Protection of Privacy and Transborder
Flows of Personal Data" adopted by the Organization for Economic Co-operation and
With 100% Correct Answers 2026-2027
Update.
Fair Information Practices - Answer Fair Information Practices (FIPs), also called Fair
Information Privacy Practices (FIPPs), are a set of principles and practices that describe how best
to approach the collection, storage, and management of data with the aim of achieving and
maintaining fairness, privacy, and security with respect to that data.1 More succinctly, FIPs are
guidelines that attempt to balance privacy interests with security and fairness. FIPs are widely
used to develop laws and regulations concerning data privacy and security. The extent to which
any FIP is legally binding changes with particular circumstance, but FIPs serve as general guiding
principles for managing, storing, and handling personal information.
Below are some important examples of FIPs that have been developed in the United States and
internationally. After these examples, we discuss the common themes that emerge from the
various examples below.
i. Early Adoption of FIPs (FIPs in the United States) - Answer There are many ways to articulate
FIPs. The first official attempt to do so in the United States occurred in 1973. That year, the
Department of Health, Education, and Welfare ("DHEW"), later renamed the Department of
Health and Human Services ("HHS"), promulgated an official set of FIPs. The DHEW identified
five different practices organizations should attempt to follow:
•
"There must be no personal-data record-keeping systems whose very existence is secret."
•
"There must be a way for an individual, to find out what information about him is in a record
and how it is used."
•
"There must be a way for an individual to prevent information about him obtained for one
purpose from being used or made available for other purposes without his consent."
•
"There must be a way for an individual to correct or amend a record of identifiable information
about him."
•
"Any organization creating, maintaining, using, or disseminating records of identifiable personal
data must assure the reliability of the data for their intended use and must take reasonable
precautions to prevent misuse of the data."
The year following the adoption of these FIPs by GHEW, Congress passed the Privacy Act of
1974.The Privacy Act of 1974, as amended, codifies a set of FIPs that govern how information
about individuals in the records of federal agencies is collected, maintained, used, and
, disseminated.Each federal agency is required to adopt rules to effect the purpose of the Privacy
Act of 1974. There can be harsh penalties for any violation of these rules, including the
imposition of civil remedies or criminal prosecution.
ii. The 2012 White House Report (FIPs in the United States) - Answer More recently, in 2012,
the White House issued a report entitled Consumer Data Privacy in a Networked World: A
Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy. The
White House included in this report a "Consumer Privacy Bill of Rights," which was a set of
principles based on traditional FIPs that the White House believed should be applied to the
commercial use of personal information. Included in this Consumer Privacy Bill of Rights were
the principles of individual control, transparency, respect for context, security, access and
accuracy, focused collection of information, and accountability. Emphasizing that these are
merely principles and that there is no one-size-fits-all approach when it comes to the
application of FIPs, the White House Report stated that "[c]ontext should shape the balance and
relative emphasis of [these] particular principles."
iii. The 2012 FTC Report (FIPs in the United States) - Answer The same year that the White
House issued this report, the Federal Trade Commission ("FTC") also issued a report on
Protecting Consumer Privacy in an Era of Rapid Change (the "2012 FTC Report").That report calls
on companies to implement various recommendations for protecting privacy, and it emphasized
three main areas of concern.
First, the FTC encouraged companies to adopt a "Privacy by Design" approach to developing
new products and services in which companies "build in" privacy as part of their systems
engineering.Put differently, a "Privacy by Design" approach calls on companies to "promote
consumer privacy throughout their organizations and at every stage of the development of their
products and services." The privacy concepts that should be "built in" to products and services
include: data security, reasonable collection limits, sound data retention and disposal practices,
and data accuracy. Similarly, the 2012 FTC Report calls on companies to "maintain
comprehensive data management procedures throughout the life cycle of their products and
services."
The second privacy principle that the 2012 FTC Report encouraged companies to adopt was
simplified consumer choice regarding how personal information is used. The FTC recognized
that consumer choice is not always required or appropriate. Rather, the availability of consumer
choice should be consistent with the context of the transaction or the company's relationship
with the consumer, unless providing consumer's the ability to make meaningful choices about
how their personal information is used is mandated by specific law or regulation. Two situations
calling for express, affirmative consumer consent are when a company seeks retroactive consent
to use personal information in a manner that is materially different than the manner in which
the data was used when ori
Examples of FIPs in International Frameworks - Answer FIPs have also been adopted
internationally. Important conventions, agreements, and frameworks tested on the CIPP/US
exam include the following: (1) the "Guidelines on the Protection of Privacy and Transborder
Flows of Personal Data" adopted by the Organization for Economic Co-operation and
