Access is the privacy concept that grants a consumer the right to view and correct errors on his or her

credit report. The Fair Credit Reporting Act (FCRA) gives consumers the right to access their credit

reports from the three nationwide credit reporting agencies (Equifax, Experian, and TransUnion)

once every 12 months for free. Consumers also have the right to dispute any inaccurate or

incomplete information in their credit reports and request that the credit reporting agencies

investigate and correct the errors. The FCRA also requires the credit reporting agencies to provide

consumers with a notice of their rights and a summary of the dispute process. Reference:

IAPP CIPP/US Certified Information Privacy Professional Study Guide, Chapter 2: Limits on Private-

sector Collection and Use of Data, Section 2.2: Consumer Privacy, p. 38-39

IAPP CIPP/US Body of Knowledge, Domain II: Limits on Private-sector Collection and Use of Data,

Objective II.B: Identify the privacy requirements for consumer data, Subobjective II.B.1: Identify the

consumer rights under the Fair Credit Reporting Act, p. 13

IAPP CIPP/US Exam Blueprint, Domain II: Limits on Private-sector Collection and Use of Data,

Objective II.B: Identify the privacy requirements for consumer data, Subobjective II.B.1: Identify the

consumer rights under the Fair Credit Reporting Act, p. 4

Based on the incident, the FTC’s enforcement actions against the marketer would most likely include

the violation of collecting information from a child under the age of thirteen without obtaining

verifiable parental consent, as required by the Children’s Online Privacy Protection Act (COPPA) Rule.

The COPPA Rule applies to operators of commercial websites and online services (including mobile

apps) that collect, use, or disclose personal information from children under 13, and operators of

general audience websites or online services that have actual knowledge that they are collecting,

using, or disclosing personal information from children under 13. The COPPA Rule also applies to

websites or online services that are directed to children under 13 and that collect personal

information from users of any age. The COPPA Rule defines personal information to include full

name, address, phone number, email address, date of birth, and other identifiers that permit the

physical or online contacting of a specific individual. The COPPA Rule requires operators to post a

clear and comprehensive online privacy policy describing their information practices for personal

information collected online from children; provide direct notice to parents and obtain verifiable

parental consent, with limited exceptions, before collecting personal information online from

children; give parents the choice of consenting to the operator’s collection and internal use of a

child’s information, but prohibiting the operator from disclosing that information to third parties

(unless disclosure is integral to the site or service, in which case, this must be made clear to parents);

provide parents access to their child’s personal information to review and/or have the information

deleted; give parents the opportunity to prevent further use or online collection of a child’s personal

information; maintain the confidentiality, security, and integrity of information they collect from

children, including by taking reasonable steps to release such information only to parties capable of

maintaining its confidentiality and security; and retain personal information collected online from a

child for only as long as is necessary to fulfill the purpose for which it was collected and delete the

information using reasonable measures to protect against its unauthorized access or use. The FTC has

the authority to seek civil penalties and injunctive relief for violations of the COPPA Rule. The FTC has

brought numerous enforcement actions against operators for violating the COPPA Rule, resulting in

millions of dollars in penalties and orders to delete illegally collected data. Reference:

Children’s Privacy | Federal Trade Commission

Kids’ Privacy (COPPA) | Federal Trade Commission

FTC Is Escalating Scrutiny of Dark Patterns, Children’s Privacy

FTC to Crack Down on Companies that Illegally Surveil Children Learning Online

FTC Takes Action Against Company for Collecting Children’s Personal Information Without Parental

Permission

[IAPP CIPP/US Certified Information Privacy Professional Study Guide], Chapter 5, pages 165-168.

The Civil Rights Act, Pregnancy Discrimination Act, Americans with Disabilities Act, Age

Discrimination Act, and Equal Pay Act are all federal laws that prohibit employment discrimination

based on certain protected characteristics, such as race, sex, disability, age, and pay1234 These laws

also afford certain classes of employees’ privacy protection by limiting inquiries concerning their

personal information that may reveal their protected status or be used for discriminatory purposes.

For example:

The Civil Rights Act of 1964 prohibits employers from making pre-employment inquiries that express

a preference, limitation, or specification based on race, color, religion, sex, or national origin, unless

they are bona fide occupational qualifications.

The Pregnancy Discrimination Act of 1978, which amended the Civil Rights Act of 1964, prohibits

employers from making pre-employment inquiries about whether an applicant is pregnant or

intends to become pregnant, unless they are related to the ability to perform the job.

The Americans with Disabilities Act of 1990 prohibits employers from making pre-employment

inquiries about whether an applicant has a disability or the nature or severity of a disability, unless

they are related to the ability to perform the essential functions of the job with or without

reasonable accommodation.

The Age Discrimination in Employment Act of 1967 prohibits employers from making pre-

employment inquiries about an applicant’s age, unless they are related to a bona fide occupational

qualification or a lawful affirmative action plan.

The Equal Pay Act of 1963 prohibits employers from making pre-employment inquiries about an

applicant’s salary history, unless they are made for a lawful purpose other than determining the

applicant’s pay.

Option A is incorrect because these laws do not require employers not to discriminate against certain

classes when employees use personal information. Rather, they require employers not to

discriminate against certain classes in any aspect of employment, such as hiring, firing, pay,

promotion, training, benefits, etc1234 The use of personal information by employees is not directly

addressed by these laws, although it may be subject to other privacy laws or policies.

Option B is incorrect because these laws do not require that employers provide reasonable

accommodations to certain classes of employees. Rather, only the Americans with Disabilities Act

and the Pregnancy Discrimination Act require employers to provide reasonable accommodations to

qualified individuals with disabilities and workers with limitations related to pregnancy, childbirth, or

related medical conditions, respectively, unless doing so would cause an undue hardship to the

employer. The other laws do not have a similar requirement, although they may prohibit employers

from denying equal opportunities to certain classes of employees.

Option C is correct because these laws afford certain classes of employees’ privacy protection by

limiting inquiries concerning their personal information that may reveal their protected status or be

used for discriminatory purposes, as explained above.

Option D is incorrect because these laws do not permit employers to use or disclose personal

information specifically about employees who are members of certain classes. Rather, these laws

generally prohibit employers from using or disclosing personal information that is protected by these

laws for any unlawful or discriminatory purpose, unless an exception applies. For example,

employers may use or disclose such information for legitimate business reasons, such as complying

with reporting requirements, administering benefits, or conducting investigations.

Reference: 1: Facts About Equal Pay and Compensation Discrimination 2: Pregnancy Discrimination

and Pregnancy-Related Disability Discrimination | U.S. Equal Employment Opportunity

Commission 3: Regulations, Guidance and Policy | Equal Opportunity Guidance | OEEOWE 4: Age

Discrimination | U.S. Equal Employment Opportunity Commission : Pre-Employment Inquiries and

Medical Questions & Examinations | U.S. Equal Employment Opportunity Commission : Employee

Medical Information | U.S. Equal Employment Opportunity Commission : Employee Privacy Rights |

U.S. Department of Labor : Title VII of the Civil Rights Act of 1964 | U.S. Equal Employment

Opportunity Commission : Fact Sheet: Pregnancy Discrimination | U.S. Equal Employment

Opportunity Commission : The Americans with Disabilities Act: A Primer for Small Business : Age

Discrimination in Employment Act of 1967 | U.S. Equal Employment Opportunity Commission : Equal

Pay Act of 1963 | U.S. Equal Employment Opportunity Commission

The Family and Medical Leave Act (FMLA) is a federal law that provides eligible employees with up to

12 weeks of unpaid, job-protected leave per year for certain family and medical reasons, such as the

birth or adoption of a child, the serious health condition of the employee or a family member, or a

qualifying exigency arising from the employee’s spouse, child, or parent being on covered active duty

or call to covered active duty status in the Armed Forces. The FMLA also provides eligible employees

with up to 26 weeks of unpaid, job-protected leave per year to care for a covered service member

with a serious injury or illness if the employee is the spouse, child, parent, or next of kin of the

service member. The FMLA applies to all public agencies, including state, local, and federal

employers, and local education agencies (schools), and to private sector employers who employ 50

or more employees for at least 20 workweeks in the current or preceding calendar year.

The FMLA often requires employers to collect medical information from employees who request

FMLA leave or from their health care providers to certify the need for leave, the duration of leave,

and the employee’s ability to return to work. The FMLA regulations specify the type and amount of

information that employers may request and require for different types of FMLA leave, such as:

Basic medical facts, such as the diagnosis, symptoms, hospitalization, doctor visits, whether

medication has been prescribed, and any referrals for evaluation or treatment, for the employee’s

own serious health condition or that of a family member.

Information on the medical necessity of intermittent leave or reduced schedule leave and the

expected frequency and duration of such leave, for the employee’s own serious health condition or

that of a family member, or for planned medical treatment.

A statement of the facts regarding the qualifying exigency, such as the type of military duty, the dates

of the covered active duty, and the contact information of the military member, for leave due to a

qualifying exigency arising from the employee’s spouse, child, or parent being on covered active duty

or call to covered active duty status in the Armed Forces.

Information on the medical condition, treatment, and recovery of the covered service member, such

as the date of injury or onset of illness, the current medical status, the prognosis, and the estimated

time of treatment, for leave to care for a covered service member with a serious injury or illness.

The FMLA also imposes certain obligations on employers to protect the privacy and security of the

medical information they collect from employees or their health care providers. For example,

employers must:

Maintain records and documents relating to medical certifications, recertifications, or medical

histories of employees or employees’ family members as confidential medical records in separate

files/records from the usual personnel files, and if the Americans with Disabilities Act (ADA) applies,

such records must be maintained in conformance with ADA confidentiality requirements.

Ensure that any electronic systems used to maintain such records meet the confidentiality

requirements of the FMLA and the ADA, and that only authorized persons have access to such

records.

Limit the disclosure of such records to supervisors and managers who need to know about an

employee’s FMLA leave, first aid and safety personnel when an employee’s medical condition might

require emergency treatment, and government officials investigating compliance with the FMLA.

Comply with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule when

requesting medical information from an employee’s health care provider, such as obtaining a valid

authorization from the employee or using a HIPAA-compliant certification form.

Refrain from requesting more information than allowed by the FMLA regulations, such as asking for

an employee’s complete medical records or information unrelated to the FMLA leave request.

Respect the employee’s right to revoke a medical authorization or challenge a medical certification,

and follow the procedures for resolving disputes over the validity or sufficiency of such documents.

Reference:

The Family and Medical Leave Act (FMLA)

FMLA Employee Guide

FMLA Employer Guide

FMLA Regulations

FMLA Forms

In 2012, the White House released a report titled “Consumer Data Privacy in a Networked World: A

Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy”, which

proposed a Consumer Privacy Bill of Rights based on the Fair Information Practice Principles (FIPPs).

The report called for a comprehensive privacy framework that would apply to all commercial sectors

and all personal data, regardless of the technology or business model involved. The report also urged

Congress to enact legislation to implement the framework and empower the FTC to enforce it.

Similarly, the FTC released a report titled “Protecting Consumer Privacy in an Era of Rapid Change:

Recommendations for Businesses and Policymakers”, which outlined a set of best practices for

businesses to protect consumer privacy and foster innovation. The report also advocated for a

comprehensive privacy framework that would cover both online and offline data, and apply to all

entities that collect or use consumer data that can be reasonably linked to a specific consumer,

computer, or device. The report also recommended that Congress consider enacting baseline privacy

legislation and giving the FTC rulemaking authority to implement it. Therefore, both reports can be

described as advocating a comprehensive approach to privacy enforcement, rather than a harm-

based, self-regulatory, or notice and choice approach. Reference: White House Report, FTC

Report, IAPP CIPP/US Study Guide (p. 31-32)

The Children’s Online Privacy Protection Act (COPPA) is a federal law that regulates the online

collection and use of personal information from children under 13 years of age. COPPA requires

operators of websites or online services that are directed to children, or that knowingly collect

personal information from children, to obtain verifiable parental consent before collecting, using, or

disclosing such information. Verifiable parental consent means any reasonable effort (taking into

consideration available technology) to ensure that before personal information is collected from a

child, the child’s parent receives notice of the operator’s information practices and consents to those

practices. COPPA also imposes other obligations on operators, such as providing parents with access

to their children’s information, maintaining reasonable security measures, and limiting data

retention. Reference: COPPA, IAPP CIPP/US Study Guide, Chapter 2, Section 2.3.1

The European approach to privacy is based on the recognition of privacy as a fundamental human

right that requires strong legal protection and oversight. The EU has adopted comprehensive and

binding privacy laws, such as the General Data Protection Regulation (GDPR) and the ePrivacy

Directive, that apply to all sectors and activities involving personal data. The EU also has independent

data protection authorities (DPAs) that monitor and enforce compliance with the privacy laws, and a

European Data Protection Board (EDPB) that issues guidance and opinions on privacy matters. The

EU also requires adequate levels of privacy protection for personal data transferred to third countries

or international organizations.

In contrast, the U.S. approach to privacy is based on a sectoral and self-regulatory model that relies

on a combination of federal and state laws, industry codes of conduct, consumer education, and

market forces. The U.S. does not have a single, comprehensive, and enforceable federal privacy law

that covers all sectors and activities involving personal data. Instead, the U.S. has a patchwork of

federal and state laws that address specific issues or sectors, such as health, financial, children’s, and

electronic communications privacy. The U.S. also has various federal and state agencies that share

jurisdiction over privacy matters, such as the Federal Trade Commission (FTC), the Federal

Communications Commission (FCC), and the Department of Health and Human Services (HHS). The

U.S. also relies on self-regulation by industries that develop and adhere to voluntary codes of

conduct, standards, and best practices for privacy. The U.S. also allows personal data to be

transferred to third countries or international organizations without requiring adequate levels of

privacy protection, as long as the data subjects have given their consent or the transfer is covered by

a mechanism such as the Privacy Shield or the Standard Contractual Clauses.

Some supporters of the European approach to privacy are skeptical about self-regulation of privacy

practices because they believe that self-regulation is not effective, consistent, or accountable enough

to protect the rights and interests of data subjects. They argue that self-regulation may not provide

sufficient incentives or sanctions for industries to comply with privacy rules, or to adopt privacy-

enhancing technologies and practices. They also contend that self-regulation may not reflect the

views and expectations of data subjects, or address the emerging and complex privacy challenges

posed by new technologies and business models. They also question the transparency and legitimacy

of self-regulation, and the ability of data subjects to exercise their rights and seek redress for privacy

violations. Reference:

IAPP CIPP/US Study Guide, Chapter 1: Introduction to the U.S. Privacy Environment, pp. 9-10, 16-17

IAPP website, CIPP/US Certification

NICCS website, Certified Information Privacy Professional/United States (CIPP/US) Training

The Cable Communications Policy Act of 1984 (CCPA) is a federal law that regulates the cable

television industry and protects the privacy of cable subscribers. One of the provisions of the CCPA is

that cable operators must provide their subscribers with an annual notice that clearly and

conspicuously informs them of the following information12:

The nature of personally identifiable information collected or to be collected with respect to the

subscriber and the nature of the use of such information

The nature, frequency, and purpose of any disclosure of such information, including an identification

of the types of persons to whom the disclosure may be made

The period during which such information will be maintained by the cable operator

The times and place at which the subscriber may have access to such information

The limitations provided by the CCPA with respect to the collection and disclosure of information by

a cable operator and the right of the subscriber under the CCPA to enforce such limitations

The annual notice must also state that the subscriber has the right to prevent disclosure of personally

identifiable information to third parties, except as required by law or court order, and that the

subscriber may sue for damages, attorney’s fees, and other relief for violations of the CCPA12.

Reference: 1: Cable Communications Policy Act of 1984, Section 631 2: [IAPP CIPP/US Study Guide],

Chapter 8, Section 8.3.2

The Colorado Privacy Act (CPA) grants consumers the right to access, correct, or delete their personal

data, including sensitive data, that is processed by a controller1. Sensitive data is defined as personal

data that reveals racial or ethnic origin, religious beliefs, mental or physical health condition or

diagnosis, sex life or sexual orientation, citizenship or citizenship status, genetic or biometric data, or

personal data from a known child2. The CPA also grants consumers the right to opt out of the

processing of their personal data for purposes of targeted advertising, the sale of personal data, or

certain kinds of profiling3. However, the CPA does not grant consumers the right to limit the use of

sensitive data for other purposes, such as providing a product or service requested by the consumer,

complying with legal obligations, or protecting the vital interests of the consumer or another

person. Therefore, option D is the correct answer, as it is not a privacy right available under the

CPA. Reference: 1: Colorado Privacy Act (CPA) - Colorado Attorney General 2: Protect Personal Data

Privacy | Colorado General Assembly 3: SENATE BILL 21-190 Woodward, Garcia; PRIVACY. COLORADO

PRIVACY ACT … : Colorado Privacy Act: What You Need to Know | OneTrust DataGuidance

The lawsuit, filed in 2014, claimed that Google violated the federal and state wiretap and privacy

laws by scanning and indexing the emails of millions of students who used its Apps for Education

suite, which included Gmail as a key feature12. The plaintiffs alleged that Google used the

information from the scans to build profiles of students that could be used for targeted advertising or

other commercial purposes, without their consent or knowledge12. The lawsuit also challenged

Google’s argument that the students consented to the scans when they first logged in to their

accounts, saying that such consent was not valid under FERPA, which requires written consent for

any disclosure of education records12. Google denied the allegations and argued that the scans were

necessary for providing security, spam protection, and other functionality to the users12. The case

was settled in 2016, with Google agreeing to change some of its practices and policies regarding the

scanning of student emails3. Reference: 1: Lawsuit Alleges That Google Has Crossed A ‘Creepy Line’

With Student Data, Huffington Post, 1. 2: Google faces lawsuit over email scanning and student data,

The Guardian, 2. 3: Google data case to be heard in Supreme Court, BBC, 3.