FACTA added a new section to the FCRA that requires any person who maintains or otherwise

possesses consumer information, or any compilation of consumer information, derived from

consumer reports for a business purpose, to properly dispose of any such information or

compilation. The purpose of this provision is to reduce the risk of identity theft and other consumer

harm resulting from improper disposal of consumer information. The FTC and other federal agencies

have issued rules implementing this provision, which specify the reasonable measures that covered

entities must take to ensure secure disposal of consumer information, such as burning, pulverizing,

shredding, erasing, or otherwise modifying the information to make it unreadable or indecipherable

(16 CFR § 682.3). Reference: 1, 2, 3

The Federal Trade Commission (FTC) issued its 2012 report, “Protecting Consumer Privacy in an Era

of Rapid Change: Recommendations for Businesses and Policymakers”1, which outlined a framework

for privacy protection based on three main principles: privacy by design, simplified consumer choice,

and greater transparency. The report also identified five priority areas for the FTC’s privacy

enforcement and policy efforts, which were:

Data brokers

Large platform providers

Mobile

Promoting enforceable self-regulatory codes

International data transfers

Do Not Track was not one of the five priority areas, but rather a specific mechanism for implementing

the principle of simplified consumer choice. The report endorsed the development of a Do Not Track

system that would allow consumers to opt out of online behavioral advertising across websites and

platforms1. The report also noted the progress made by various stakeholders, such as the World

Wide Web Consortium (W3C), the Digital Advertising Alliance (DAA), and browser companies, in

advancing the Do Not Track initiative1. Reference: 1: Federal Trade Commission, Protecting

Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers

(March 2012), available at 1.

The Gramm-Leach-Bliley Act (GLBA) is a federal law that regulates the privacy and security of

consumer financial information collected, used, and disclosed by financial institutions, such as banks,

credit unions, securities firms, insurance companies, and others12. Under the GLBA, financial

institutions must comply with two main rules: the Privacy Rule and the Safeguards Rule12. The

Privacy Rule requires financial institutions to provide notice to their customers about their

information-sharing practices and to obtain verifiable parental consent before collecting, using, or

disclosing personal information from children12. The Privacy Rule also gives customers the right to

opt out of having their personal information shared with certain nonaffiliated third parties, unless an

exception applies12. The Safeguards Rule requires financial institutions to develop, implement, and

maintain a comprehensive information security program that protects the confidentiality, security,

and integrity of customer information12.

Therefore, banks and other financial institutions are required to offer an opt-out before transferring

personal information (PI) to an unaffiliated third party for the latter’s own use, unless an exception

applies, such as when the disclosure is necessary to complete a transaction requested or authorized

by the customer, or when the disclosure is to a service provider or joint marketer that agrees to

protect the information and use it only for the purposes for which it was disclosed12. This

requirement is intended to give customers more control over how their personal information is used

and shared by financial institutions and to protect their privacy rights12.

Reference: 1: Gramm-Leach-Bliley Act | Federal Trade Commission, 1. 2: How To Comply with the

Privacy of Consumer Financial Information Rule of the Gramm-Leach-Bliley Act | Federal Trade

Commission, 2.

The U.S. Constitution plays a limited role in the area of workplace privacy, because it mainly applies

to the actions of the government, not private employers. The Fourth Amendment protects the right

of the people to be secure in their persons, houses, papers, and effects, against unreasonable

searches and seizures1. The Supreme Court has interpreted this right to include a reasonable

expectation of privacy in certain situations, such as in one’s home, car, or personal

belongings2. However, this right does not extend to private-sector employees, who are not

protected by the Constitution from the actions of their employers, unless the employer is acting as

an agent of the government3. Private-sector employees may have some privacy rights under state

laws, common law, or contractual agreements, but these vary depending on the jurisdiction and the

circumstances4.

Public-sector employees, on the other hand, are protected by the Constitution from unreasonable

searches and seizures by their employers, who are considered part of the government. Public-sector

employees have a reasonable expectation of privacy in their workplace, unless there is a legitimate

work-related reason for the search or seizure, such as to ensure safety, security, or efficiency. Public-

sector employers must also comply with the due process and equal protection clauses of the Fifth

and Fourteenth Amendments, which prohibit the government from depriving any person of life,

liberty, or property without due process of law, or from denying any person the equal protection of

the laws. These clauses protect public-sector employees from arbitrary or discriminatory actions by

their employers that affect their employment status or benefits.

Therefore, the U.S. Constitution plays a significant role in the area of workplace privacy for federal

and state governments, but not for private-sector employment, because it only regulates the actions

of the government, not private actors. Reference:

1: Cornell Law School, Fourth Amendment,

https://www.law.cornell.edu/constitution/fourth_amendment

2: FindLaw, What Is a Reasonable Expectation of Privacy?,

https://www.findlaw.com/criminal/criminal-rights/what-is-a-reasonable-expectation-of-privacy.html

3: FindLaw, Workplace Privacy, https://www.findlaw.com/smallbusiness/employment-law-andhuman-resources/workplace-privacy.html

4: Nolo, Privacy Rights of Employees, https://www.nolo.com/legal-encyclopedia/privacy-rightsemployees-29849.html

: OPM, Employee Relations, https://www.opm.gov/policy-data-oversight/employeerelations/reference-materials/employee-privacy/

: Cornell Law School, Fifth Amendment, https://www.law.cornell.edu/constitution/fifth_amendment

: FindLaw, Public Employees and the Constitution,

https://www.findlaw.com/employment/employment-rights/public-employees-and-theconstitution.html

According to the web search results from my predefined tool, Florida is the only state among the four

options that currently imposes a definite limit for notification to affected individuals in case of a data

breach. Florida’s law requires that notice be provided within 30 days after determination of the

breach or reason to believe a breach occurred, unless delayed by law enforcement or measures to

determine the scope of the breach and restore the integrity of the system1. The other states have

more flexible or vague terms for the notification timeframe, such as “as soon as practicable” (Maine),

“in the most expedient time possible and without unreasonable delay” (New York), or “in the most

expedient time possible and without unreasonable delay, consistent with the legitimate needs of law

enforcement” (California)2. Reference:

Security Breach Notification Chart | Perkins Coie

State Data Breach Notification Chart - International Association of …

The Fair Credit Reporting Act (FCRA) was originally intended to provide consumers with the ability to

correct inaccurate credit information that could affect their access to credit, employment, insurance,

and other benefits. The FCRA gives consumers the right to access their credit reports from the three

major credit reporting agencies (Equifax, Experian, and TransUnion) for free once every 12 months,

and to dispute any errors or inaccuracies with the credit reporting agencies or the information

furnishers (such as lenders, creditors, or debt collectors). The FCRA also requires the credit reporting

agencies and the information furnishers to investigate and resolve the disputes within 30 days, and

to delete or correct any information that is found to be inaccurate, incomplete, or outdated. The

FCRA also provides consumers with the right to place fraud alerts or security freezes on their credit

reports if they are victims or potential victims of identity theft, and to receive notifications from

users of their credit reports (such as employers or insurers) if any adverse action is taken based on

their credit information. Reference:

Fair Credit Reporting Act - Wikipedia

What is the Fair Credit Reporting Act (FCRA)? | Money

The Fair Credit Reporting Act of 1970 - The Balance

How the Fair Credit Reporting Act (FCRA) Protects Consumer Rights

The Foreign Intelligence Surveillance Act (FISA) was enacted in 1978 in response to revelations of

widespread privacy violations by the federal government under President Nixon. It established

procedures for requesting judicial authorization for electronic surveillance and physical search of

persons engaged in espionage or international terrorism against the United States on behalf of a

foreign power1 The original purpose of FISA was to further define a framework for authorizing

wiretaps by the executive branch for national security purposes under Article II of the Constitution,

which grants the president the power to conduct foreign affairs and defend the nation23 FISA was

intended to balance the need for collecting foreign intelligence information with the protection of

privacy and civil liberties of U.S. persons4 Reference:  https://www.intelligence.gov/foreignintelligence-surveillance-act

https://www.intelligence.gov/foreign-intelligence-surveillance-act/1234-categories-of-fisa

A data ethics framework is a set of principles and guidelines that help organizations ensure that their

data practices are ethical, responsible, and trustworthy. According to the IAPP CIPP/US Study Guide,

some of the key components of a data ethics framework are1:

Data governance: the policies, processes, and standards that govern how data is collected, used,

stored, and shared within an organization.

Preferability testing: the process of assessing the potential impacts and risks of data-driven solutions

on stakeholders, such as customers, employees, and society.

Auditing: the process of monitoring, reviewing, and verifying the compliance and performance of

data practices against the established ethical standards and legal requirements. Automated decision-

making, on the other hand, is not a key component of a data ethics framework, but rather a data

practice that may raise ethical issues and challenges. Automated decision-making refers to the use of

algorithms, artificial intelligence, or machine learning to make decisions or recommendations

without human intervention2. While automated decision-making can offer benefits such as

efficiency, accuracy, and consistency, it can also pose risks such as bias, discrimination, lack of

transparency, and accountability3. Therefore, automated decision-making should be subject to

ethical evaluation and oversight, but it is not itself a part of a data ethics framework. Reference:

[IAPP CIPP/US Study Guide], Chapter 10, Section 10.4, page 287

[IAPP Glossary], Automated Decision-Making

IAPP Resources, Ethical Data Use and Automated Decision-Making: A Practical Guide

The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of

student education records and gives parents or eligible students the right to access, amend, and

control the disclosure of their records. FERPA applies to all educational agencies and institutions that

receive funds under any program administered by the U.S. Department of Education12

FERPA requires schools to do all of the following:

Verify the identity of students who make requests for access to their records. Schools must use

reasonable methods to identify and authenticate the identity of parents, students, school officials,

and any other parties to whom they disclose education records12

Provide students with access to their records within a specified amount of time. Schools must

provide parents or eligible students with an opportunity to inspect and review the student’s

education records within 45 days of receiving a request. Schools are not required to provide copies of

records unless it is impossible for parents or eligible students to review the records at the school12

Respond to all reasonable student requests regarding explanation of their records. Schools must

provide parents or eligible students with an opportunity to request the amendment of the student’s

education records that they believe are inaccurate, misleading, or otherwise in violation of the

student’s privacy rights. Schools must consider the request and decide whether to amend the records

within a reasonable time. If the school decides not to amend the records, it must inform the parent

or eligible student of their right to a hearing on the matter12

FERPA does not require schools to do the following:

Obtain student authorization before releasing directory information in their records. Directory

information is information contained in a student’s education record that would not generally be

considered harmful or an invasion of privacy if disclosed. Examples of directory information include

the student’s name, address, phone number, e-mail address, date and place of birth, major field of

study, participation in sports and activities, dates of attendance, degrees and awards received, and

most recent school attended. Schools may disclose directory information without consent unless the

parent or eligible student has opted out of such disclosure. Schools must notify parents and eligible

students of the types of information they designate as directory information and of their right to opt

out of directory information disclosure12

Therefore, the correct answer is D. Obtain student authorization before releasing directory

information in their records.

Reference:

Family Educational Rights and Privacy Act (FERPA)

IAPP CIPP/US Certified Information Privacy Professional Study Guide, Chapter 4: Federal Privacy

Laws, Section 4.3: The Family Educational Rights and Privacy Act (FERPA)

When implementing data portability, organizations often face significant challenges due to the

complexity of managing data transfers. These challenges commonly include concerns about third-

party data, technical compatibility for data transmission, and security considerations. However, the

technical skillsets available in the transmitting organization is NOT typically identified as a primary

challenge because most organizations have or can acquire the necessary technical expertise through

training or by outsourcing.

Explanation of Options:

A . The presence of third-party data in the data to be ported: This is a valid challenge, as the inclusion

of third-party data can raise legal and contractual concerns about ownership and transferability.

B . Technically compatible systems for transmission feasibility: Ensuring that data can be transferred

between systems in compatible formats is a critical and common challenge.

C . Security considerations in relation to the transfer of the data: Data transfers must be secure to

prevent unauthorized access or breaches, making this a valid challenge.

D . The technical skillsets available in the transmitting organization: While technical skills are

important, organizations usually have the ability to address this issue through hiring, training, or

outsourcing, making this the least common challenge.

Reference from CIPP/US Materials:

IAPP CIPP/US Certification Textbook: Discusses operational challenges related to data portability,

including system compatibility, data security, and third-party involvement.

NIST Privacy Framework: Addresses organizational readiness and data transfer risks.