Certified Information Privacy Professional/US (CIPP/US) practice questions

An FBI agent serves a provider with a National Security Letter and includes a nondisclosure requirement barring the provider from telling anyone, including the affected customer, that it received the NSL. The provider's counsel wants to know how the USA FREEDOM Act altered the legal posture of that nondisclosure requirement. Which statement is correct?

• AThe provider may seek judicial review of the nondisclosure requirement, and the government must periodically reassess whether continued secrecy remains justified.check_circle Correct
• BThe nondisclosure requirement is now permanent once imposed, and the provider has no statutory mechanism to seek its removal at any later time.
• CThe nondisclosure requirement was abolished entirely, so providers receiving NSLs may now freely publish the specific contents of any NSL they receive.
• DThe provider may disclose the NSL only after first obtaining written authorisation from the Foreign Intelligence Surveillance Court for each individual customer affected.

Why A is correct: Correct: USA FREEDOM established judicial-review procedures for NSL gag orders and reciprocal notice requiring the government to revisit whether nondisclosure is still warranted.

Why B is wrong: Tempting because NSL gag orders were historically open-ended, but USA FREEDOM created review and termination mechanisms, so the gag is not permanent and unchallengeable.

Why C is wrong: Tempting because reforms increased transparency, but USA FREEDOM did not abolish NSL gags; it added procedures and reciprocal-notice rules rather than removing them.

Why D is wrong: Tempting because the FISC oversees national security matters, but NSL nondisclosure review runs through ordinary judicial-review procedures, not per-customer FISC authorisation.

A technology company has not violated any specific privacy statute, yet the Federal Trade Commission opens an enforcement action alleging the company misrepresented its data-sharing practices to consumers. On what legal source does the FTC most directly rely to bring this action?

• AThe common law tort of intrusion upon seclusion, which the FTC enforces on behalf of consumers in federal court.
• BIts statutory authority under Section 5 of the FTC Act to challenge unfair or deceptive acts or practices.check_circle Correct
• CA constitutional right to fair dealing implied by the Due Process Clause of the Fourteenth Amendment.
• DA self-regulatory code of conduct that the company adopted and the FTC enforces as binding federal regulation.

Why A is wrong: Tempting because intrusion is a privacy wrong, but it is a private tort claim brought by individuals, not a statutory power the FTC invokes for enforcement.

Why B is correct: Correct: Section 5 of the FTC Act prohibits unfair or deceptive acts or practices, letting the FTC act on a misrepresentation even where no specific privacy statute applies.

Why C is wrong: Tempting because due process sounds protective, but it limits government conduct toward individuals and is not the source of FTC authority over deceptive business practices.

Why D is wrong: Tempting because broken promises in a code can support a case, but the code is not itself the legal source, and the FTC's authority flows from the FTC Act.

A regional retailer's general counsel learns that a former employee has filed a wrongful-termination suit and that litigation is now reasonably anticipated. The company runs an email system with a 90-day auto-deletion policy that purges mailboxes nightly. To meet its obligations under the Federal Rules of Civil Procedure, what is the counsel's most immediate and direct duty regarding the relevant electronically stored information?

• AIssue a litigation hold that suspends routine auto-deletion for the custodians and data sources likely to hold relevant information.check_circle Correct
• BWait until the opposing party serves a formal discovery request before taking any action to preserve the relevant mailboxes.
• CImmediately collect and produce all potentially relevant emails to opposing counsel to demonstrate good faith.
• DMigrate all company mailboxes to a new archive platform and apply the 90-day policy uniformly going forward.

Why A is correct: Once litigation is reasonably anticipated, the duty to preserve attaches and counsel must suspend routine destruction by issuing a litigation hold to relevant custodians and systems, which is the immediate and direct preservation step.

Why B is wrong: This is tempting because formal requests do trigger production obligations, but the preservation duty attaches when litigation is reasonably anticipated, well before any request is served, so waiting risks spoliation.

Why C is wrong: This sounds proactive, but production happens during discovery on relevant, proportional material after meet-and-confer, not by dumping everything at the outset, and it does not address preservation of data still being purged.

Why D is wrong: Standardising retention may seem like sound governance, but continuing a 90-day purge would keep destroying relevant information that must be preserved, so this fails the preservation duty rather than satisfying it.