Discuss IAPP CIPP/US Exam Topic 4 Question 92

Which of the following accurately describes the purpose of a particular federal enforcement agency?

AThe National Institute of Standards and Technology (NIST) has established mandatory privacy standards that can then be enforced against all for-profit organizations by the Department of Justice (DOJ).

BThe Cybersecurity and Infrastructure Security Agency (CISA) is authorized to bring civil enforcement actions against organizations whose website or other online service fails to adequately secure personal information.

CThe Federal Communications Commission (FCC) regulates privacy practices on the internet and enforces violations relating to websites' posted privacy disclosures.

DThe Federal Trade Commission (FTC) is typically recognized as having the broadest authority under the FTC Act to address unfair or deceptive privacy practices.

Suggested Answer: D

The FTC is the primary federal agency responsible for enforcing privacy and data security laws in the United States. The FTC has broad jurisdiction over most commercial entities that collect, use, or share personal information from consumers. The FTC Act prohibits unfair or deceptive acts or practices in or affecting commerce, which includes unfair or deceptive privacy practices. The FTC can bring enforcement actions against companies that violate their own privacy policies, fail to provide adequate notice or choice to consumers, engage in unfair or harmful data practices, or breach consumers' reasonable expectations of privacy. The FTC can also issue rules, guidelines, and reports on privacy and data security issues, as well as conduct investigations, workshops, and educational campaigns.Reference:

IAPP CIPP/US Body of Knowledge, Section I.A.1.a

IAPP CIPP/US Textbook, Chapter 1, pp. 9-12

FTC Privacy and Security Enforcement

Get Premium CIPP/US Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

26 comments · newest first

Joaquin 29 days ago

Definitely D. FTC is key in privacy enforcement.

Mariko 1 month ago

A is misleading. NIST sets standards, not enforceable by DOJ.

Santos 1 month ago

B is interesting, but CISA's role is more limited.

Sheridan 1 month ago

C sounds good too, but FCC is more about communications.

Lachelle 2 months ago

Agreed! FTC really tackles unfair practices.

Lawanda 2 months ago

I think D is the best choice. FTC has broad authority.

Merissa 2 months ago

I feel confident about D. FTC is well-known for this.

Donte 2 months ago

C is misleading. FCC focuses more on communications.

Clorinda 2 months ago

B is interesting, but C seems off too.

Billi 3 months ago

A sounds wrong. NIST doesn't enforce standards.

Beth 3 months ago

I agree, D makes sense. They handle deceptive practices.

Lisbeth 3 months ago

I think it's D. FTC has the broadest authority.

Myong 3 months ago

Really? I’m surprised CISA can take civil actions, seems a bit much.

Janella 3 months ago

B) sounds right, CISA is all about cybersecurity!

Sol 3 months ago

C) I thought FCC only dealt with communications, not privacy?

Daniela 4 months ago

D) is spot on! FTC really does have broad authority.

Oretha 4 months ago

A) is totally wrong, NIST doesn't enforce anything.

Floyd 4 months ago

I thought NIST was just about standards, not enforcement.

Moon 4 months ago

FCC doesn't really regulate internet privacy, right?

Arleen 4 months ago

Wait, CISA can actually take civil actions? That's news to me!

Ruthann 6 months ago

Totally agree, it's the FTC that has the broadest authority!

Wayne 6 months ago

NIST doesn't enforce privacy standards, that's a myth.

Odette 6 months ago

I vaguely recall something about CISA, but I’m not confident it has civil enforcement powers like B suggests.

Destiny 7 months ago

I practiced a similar question where the FTC was mentioned as having broad authority, so I’m leaning towards D as well.

Eladia 7 months ago

I'm not entirely sure, but I feel like C could be misleading since the FCC mainly deals with communications rather than privacy.

Lorrine 7 months ago

I remember studying about the FTC and its role in privacy enforcement, so I think D might be the right answer.

IAPP CIPP/US Exam - Topic 4 Question 92 Discussion