Certified - CIPP/US Audio Course

The Family Educational Rights and Privacy Act (FERPA) governs the privacy of student education records. This episode explains the rights it grants to parents and students, including access, correction, and consent for disclosure. We’ll also review exceptions, such as disclosures to school officials or in cases of health and safety emergencies. We’ll highlight how FERPA applies to both K–12 and hig...

Mergers and acquisitions often involve transferring large volumes of personal data. This episode explains the privacy implications of corporate transactions, including how due diligence identifies risks and how contracts manage ongoing obligations. We’ll also discuss how regulators evaluate whether consumer consent is required when data changes hands. For exam purposes, you should understand how p...

Online banking raises unique privacy issues. This episode looks at how institutions use biometrics for authentication, the risks of third-party tracking in financial apps, and the growing security concerns in digital transactions. We’ll explore how these practices intersect with existing financial privacy laws, including GLBA, FCRA, and state breach notification statutes. We’ll also examine how re...

The Dodd-Frank Wall Street Reform and Consumer Protection Act created the Consumer Financial Protection Bureau (CFPB), which plays a central role in financial privacy. This episode explains the CFPB’s authority, its supervision of financial institutions, and its role in enforcing consumer privacy protections. We’ll also cover how Dodd-Frank introduced new requirements for transparency, accountabil...

The Red Flags Rule is designed to help organizations detect, prevent, and mitigate identity theft. This episode explains how financial institutions and certain creditors must develop programs that identify warning signs—or “red flags”—of potential fraud. We’ll review the categories of red flags, from suspicious documents to unusual account activity, and discuss how compliance programs integrate mo...

The Gramm-Leach-Bliley Act (GLBA) governs privacy in the financial services sector. This episode introduces the GLBA Privacy Rule, which requires clear disclosures about data sharing and provides consumers the right to opt out of certain uses. We’ll also cover the Safeguards Rule, mandating administrative, technical, and physical protections for customer data. Importantly, we explore how some stat...

Financial data is heavily regulated in the U.S., and two major statutes govern its use: the Fair Credit Reporting Act (FCRA) and the Fair and Accurate Credit Transactions Act (FACTA). In this episode, we examine how FCRA establishes accuracy, permissible purpose, and consumer rights to access and correct information. FACTA builds on this by addressing identity theft and credit reporting practices....

Health information involving substance use disorder patients receives special protections under federal law. This episode explains 42 CFR Part 2, which imposes stricter confidentiality standards than HIPAA. We’ll discuss what types of programs and providers are covered, the rules for consent, and the limits on disclosure even to law enforcement and other agencies. These protections aim to reduce s...

The 21st Century Cures Act sought to promote innovation by improving interoperability and data sharing in healthcare. This episode explains how the Act prohibits “information blocking,” requiring health IT systems to enable secure, authorized data exchange. While designed to empower patients and providers, these provisions also raise privacy and security challenges. We’ll review how regulators bal...

The Health Information Technology for Economic and Clinical Health Act (HITECH) strengthened HIPAA enforcement and introduced federal breach notification requirements. This episode explores how HITECH increased penalties, expanded liability to business associates, and mandated reporting of breaches affecting 500 or more individuals. We’ll also examine how it encouraged adoption of electronic healt...

Complementing the Privacy Rule, the HIPAA Security Rule sets standards for protecting electronic protected health information (ePHI). This episode breaks down its three safeguard categories: administrative, physical, and technical. Administrative safeguards include policies, risk analyses, and workforce training. Physical safeguards address facility access and workstation security. Technical safeg...

The Health Insurance Portability and Accountability Act (HIPAA) remains one of the most significant federal privacy statutes. This episode explains the Privacy Rule, which establishes protections for protected health information (PHI). We’ll cover covered entities, business associates, permitted uses and disclosures, and the rights of individuals under HIPAA. This foundation is critical for unders...

Privacy law continues to evolve as technology advances. This episode highlights priority areas identified by regulators and policymakers, including the risks posed by data brokers, the proliferation of Internet of Things devices, the rise of artificial intelligence, and the expanding use of biometric identifiers. We’ll discuss why these areas raise unique concerns and how regulators are responding...

Enforcement brings theory into practice. In this episode, we review major FTC privacy and data security cases, highlighting recurring themes such as inadequate security, deceptive disclosures, and failure to honor stated practices. These case studies illustrate how the FTC frames violations and the remedies it imposes, from fines to compliance monitoring. We’ll also analyze settlement patterns, wh...

Children’s privacy carries heightened protections in U.S. law. This episode introduces the Children’s Online Privacy Protection Act (COPPA), which governs the collection of personal information from children under 13. We’ll break down requirements such as verifiable parental consent, privacy notice disclosures, and limits on data use and sharing. Enforcement by the FTC has made COPPA one of the mo...

The Federal Trade Commission is often described as the nation’s top privacy cop. This episode dives into Section 5 of the FTC Act, which prohibits unfair and deceptive acts or practices. We’ll examine how the FTC uses this authority to address privacy and data security, even without specific statutes. Notable cases have established expectations for transparency in privacy notices, promises about d...

Domain II focuses on federal and state laws governing specific sectors such as health, finance, education, and telecommunications. This episode introduces the federal “sectoral” approach, where distinct statutes regulate different industries rather than one overarching law. We contrast this with state-level frameworks that increasingly take comprehensive approaches, such as California’s CCPA and C...

This episode explores how U.S. privacy frameworks compare to the European Union’s General Data Protection Regulation (GDPR) and Switzerland’s Federal Act on Data Protection (FADP). We’ll review differences in scope, enforcement powers, and individual rights. While U.S. privacy law is fragmented across federal and state systems, GDPR and FADP establish comprehensive regimes that apply broadly acros...

Privacy law collides with other legal obligations when organizations face multinational conflicts. This episode highlights the tension between U.S. e-discovery requirements in litigation and EU data protection laws that restrict data transfers. Companies must navigate competing demands, often under tight timelines, while minimizing the risk of penalties from either jurisdiction. We’ll discuss real...

U.S. companies regularly transfer data across borders, triggering international privacy obligations. This episode introduces the Schrems cases, which invalidated earlier EU-U.S. transfer mechanisms, and explains how Standard Contractual Clauses (SCCs) remain a cornerstone of compliance. We also cover the EU-U.S. Data Privacy Framework, designed to restore lawful transfer channels under stricter sa...

The online environment presents unique privacy risks. This episode examines how tracking technologies, behavioral profiling, and targeted advertising shape consumer experiences and regulatory responses. We’ll explore how cookies, pixels, and mobile identifiers operate, and why transparency and consent requirements are central to online privacy frameworks. We also discuss how consumer expectations...

Data has a lifecycle, and managing it responsibly is critical for privacy compliance. This episode covers retention schedules that specify how long data must be kept, archival practices for historical or legal purposes, and secure disposal methods to prevent unauthorized access. We also explore the role of legal holds, which suspend deletion when litigation or investigations are pending. Balancing...

Accountability is the thread connecting all privacy obligations. In this episode, we define accountability models as frameworks for demonstrating compliance through documentation, assessments, and governance structures. Examples include risk assessments, data protection impact assessments, and ongoing monitoring. These models serve as proof that an organization has taken reasonable steps to protec...

Privacy law intersects with cybersecurity when incidents occur. This episode explains how organizations build incident response programs to address threats like ransomware, data breaches, and vendor security failures. We’ll cover the steps of detection, containment, investigation, notification, and remediation, highlighting where privacy law imposes specific obligations. We also look at how regula...

Cloud services and third-party vendors introduce unique privacy challenges. This episode examines how processing agreements define roles and responsibilities between controllers and processors, including clauses on security, breach notification, and sub-processing. Due diligence processes—such as audits, questionnaires, and certifications—help ensure vendors meet contractual and regulatory require...