CIPP/US Workplace Privacy & Employee Monitoring — Questions and Answers

Question 1: Under the Electronic Communications Privacy Act (ECPA), which exception most commonly allows employers to monitor employee email on company systems?

The business extension exception (Correct answer)
The law enforcement exception
The prior consent exception
The national security exception

Correct answer: The business extension exception

The business extension exception under ECPA permits employers to monitor communications over equipment provided in the ordinary course of business.

Question 2: An employer wants to conduct pre-employment background checks. Under the Fair Credit Reporting Act (FCRA), what must the employer provide to the applicant before taking adverse action based on the report?

A pre-adverse action notice and a copy of the report (Correct answer)
Only a final adverse action notice
A written explanation without the report
No notice is required for employment purposes

Correct answer: A pre-adverse action notice and a copy of the report

FCRA requires employers to provide a pre-adverse action notice, a copy of the consumer report, and a summary of consumer rights before taking adverse action.

Question 3: Which of the following best describes the general legal standard for employee privacy expectations in the workplace?

Employees have a diminished expectation of privacy compared to the general public (Correct answer)
Employees retain full Fourth Amendment protections in private workplaces
Employers may never monitor employee communications without a court order
Employees and employers share equal privacy rights in the workplace

Correct answer: Employees have a diminished expectation of privacy compared to the general public

Courts generally recognize that employees have a reduced expectation of privacy in the workplace, particularly when using employer-owned equipment and systems.

Question 4: A company implements keystroke logging software on all employee computers. What is the most important step the company should take to limit privacy risk?

Provide clear notice to employees through an acceptable use policy (Correct answer)
Obtain a court order before deploying the software
Limit monitoring to only remote workers
Encrypt all logged keystrokes and never review them

Correct answer: Provide clear notice to employees through an acceptable use policy

Providing clear notice through an acceptable use or monitoring policy reduces privacy risk and supports the business extension exception under ECPA.

Question 5: Under the ADA (Americans with Disabilities Act), when may an employer require a medical examination of a current employee?

Only when it is job-related and consistent with business necessity (Correct answer)
At any time as part of annual performance reviews
Whenever the employer suspects drug or alcohol use
Only after the employee has been employed for at least one year

Correct answer: Only when it is job-related and consistent with business necessity

The ADA allows medical examinations of current employees only if they are job-related and consistent with business necessity, protecting employee medical privacy.

Question 6: Which federal law primarily governs the privacy of employee polygraph testing in the private sector?

The Employee Polygraph Protection Act (EPPA) (Correct answer)
The Fair Labor Standards Act (FLSA)
The National Labor Relations Act (NLRA)
The Privacy Act of 1974

Correct answer: The Employee Polygraph Protection Act (EPPA)

The Employee Polygraph Protection Act (EPPA) generally prohibits most private employers from using polygraph tests for pre-employment screening or during employment.

Question 7: An employer in California wants to monitor employee social media accounts. Which California law most directly addresses this practice?

California Labor Code Section 980, which prohibits employers from demanding access to personal social media accounts (Correct answer)
The California Consumer Privacy Act (CCPA), which treats employee social media as personal data
The California Confidentiality of Medical Information Act (CMIA)
California's unfair business practices statute under Business & Professions Code Section 17200

Correct answer: California Labor Code Section 980, which prohibits employers from demanding access to personal social media accounts

California Labor Code Section 980 prohibits employers from requiring employees or applicants to disclose their personal social media usernames or passwords.

Question 8: What does the concept of 'reasonable expectation of privacy' from Katz v. United States mean in the context of public-sector workplace monitoring?

Government employees may have Fourth Amendment protections against unreasonable searches of their workplace spaces (Correct answer)
Government employees have no privacy rights in any government-owned property
Only private-sector employees can invoke the reasonable expectation of privacy doctrine
Reasonable expectation of privacy applies only to physical spaces, not digital communications

Correct answer: Government employees may have Fourth Amendment protections against unreasonable searches of their workplace spaces

The Katz standard establishes that government employees can have Fourth Amendment protections against unreasonable workplace searches, subject to balancing tests.

Question 9: Under the FCRA, how long before taking adverse employment action must an employer wait after providing the pre-adverse action notice?

A reasonable period of time (generally interpreted as at least 5 business days) (Correct answer)
72 hours
30 calendar days
No waiting period is required; the notice is purely informational

Correct answer: A reasonable period of time (generally interpreted as at least 5 business days)

FCRA requires a 'reasonable period of time' between the pre-adverse action notice and final adverse action, which the FTC has interpreted as approximately five business days.

Question 10: Which of the following is an accurate statement about drug testing in the workplace under federal law?

There is no comprehensive federal law mandating private-sector drug testing, though certain industries are federally regulated (Correct answer)
The Drug-Free Workplace Act requires all federal contractors to test employees for drugs
OSHA mandates random drug testing for all employees in safety-sensitive positions
The ADA prohibits all workplace drug testing as a form of disability-related inquiry

Correct answer: There is no comprehensive federal law mandating private-sector drug testing, though certain industries are federally regulated

No single federal law mandates drug testing for all private-sector employees; however, sector-specific regulations (e.g., DOT for transportation workers) require testing in certain industries.

Question 11: An employer collects biometric data (fingerprints) for employee time-and-attendance tracking. Which state law is most commonly associated with strict regulation of biometric data collection in employment?

Illinois Biometric Information Privacy Act (BIPA) (Correct answer)
California Consumer Privacy Act (CCPA)
New York SHIELD Act
Texas Identity Theft Enforcement and Protection Act

Correct answer: Illinois Biometric Information Privacy Act (BIPA)

The Illinois BIPA is the most prominent and strictly enforced biometric privacy law in the U.S., requiring informed consent, written policies, and limiting data retention and disclosure.

Question 12: The National Labor Relations Act (NLRA) intersects with workplace privacy because it:

Protects employees' rights to engage in concerted activities, which can limit how employers monitor and discipline workers for discussing wages or working conditions (Correct answer)
Requires employers to preserve all employee communications for labor dispute resolution
Grants unions the right to access all employer monitoring records
Prohibits all surveillance of union employees without NLRB approval

Correct answer: Protects employees' rights to engage in concerted activities, which can limit how employers monitor and discipline workers for discussing wages or working conditions

The NLRA protects concerted activity, meaning employer monitoring policies that chill employees' rights to discuss wages or working conditions may constitute unfair labor practices.

Question 13: A terminated employee requests access to their personnel file. Under which legal framework are they most likely to have this right?

State law, as there is no federal law granting private-sector employees access to their personnel files (Correct answer)
The Privacy Act of 1974, which covers all employment records
HIPAA, because personnel files contain health-related information
The FCRA, which mandates employer disclosure of all records used in employment decisions

Correct answer: State law, as there is no federal law granting private-sector employees access to their personnel files

The right of private-sector employees to access their personnel files is governed by state law; states like California, Michigan, and Illinois have specific personnel file access statutes.

Question 14: When an employer uses a third-party vendor to conduct social media screening of job applicants, the employer must be aware that this practice may trigger obligations under:

The FCRA, if the vendor is considered a consumer reporting agency compiling consumer reports (Correct answer)
HIPAA, because social media may contain protected health information
The ECPA, because accessing social media constitutes electronic interception
The ADA, because social media may reveal disability status

Correct answer: The FCRA, if the vendor is considered a consumer reporting agency compiling consumer reports

If a third-party vendor compiles social media information into a report used for employment decisions, it may constitute a consumer report under FCRA, triggering disclosure and adverse action requirements.

Question 15: Under HIPAA, how must an employer handle employee health information obtained through a self-insured health plan?

It must be kept separate from other personnel records and accessed only by those who need it to administer the plan (Correct answer)
It may be freely shared with supervisors for accommodation purposes
It is exempt from HIPAA because employment records are excluded
It must be destroyed within 60 days of receipt

Correct answer: It must be kept separate from other personnel records and accessed only by those who need it to administer the plan

HIPAA requires employers who sponsor self-insured health plans to maintain health information separately and limit access to plan administration personnel only.

Question 16: An employee notifies their manager of a disability and requests a reasonable accommodation. Under the ADA, the employer's privacy obligation regarding this disclosure is to:

Keep the medical information confidential and share it only with those who have a specific need to know on a need-to-know basis (Correct answer)
File it with the EEOC within 30 days
Disclose it to HR and the employee's entire team to facilitate the accommodation
Retain it in the general personnel file for documentation purposes

Correct answer: Keep the medical information confidential and share it only with those who have a specific need to know on a need-to-know basis

The ADA requires that medical information obtained through the accommodation process be kept confidential and disclosed only to those with a legitimate need to know.

Question 17: Which of the following is the best practice when an employer wants to implement video surveillance of the workplace?

Provide employees with advance notice of the surveillance through a written policy, avoiding placement in areas where employees have a heightened expectation of privacy such as restrooms (Correct answer)
Install cameras in all areas including restrooms to deter theft
Obtain signed waivers from each employee consenting to 24-hour surveillance
Notify only senior management and security personnel to preserve the deterrent effect

Correct answer: Provide employees with advance notice of the surveillance through a written policy, avoiding placement in areas where employees have a heightened expectation of privacy such as restrooms

Best practice requires advance notice to employees and avoidance of locations (restrooms, changing rooms) where employees retain a reasonable expectation of privacy, balancing business interests with employee rights.

Question 18: What is the primary purpose of an employee privacy notice under the California Consumer Privacy Act (CCPA) as amended by the CPRA?

To inform employees about the categories of personal information collected about them and the purposes for which it is used (Correct answer)
To obtain employee consent before collecting any personal data
To comply with HIPAA's notice of privacy practices requirement
To satisfy FCRA's pre-adverse action disclosure obligations

Correct answer: To inform employees about the categories of personal information collected about them and the purposes for which it is used

The CPRA requires employers to provide a privacy notice at or before collection informing California employees about the categories of personal information collected and the purposes of use.

Question 19: An employer conducts an internal investigation of an employee suspected of misconduct. From a workplace privacy perspective, which approach best balances employer and employee interests?

Limiting the investigation to relevant evidence, informing only those with a need to know, and documenting the process to demonstrate proportionality (Correct answer)
Conducting a broad investigation of all employee communications to ensure thoroughness
Publicizing the investigation to deter future misconduct by other employees
Delegating the investigation entirely to law enforcement to avoid privacy liability

Correct answer: Limiting the investigation to relevant evidence, informing only those with a need to know, and documenting the process to demonstrate proportionality

A proportionate, confidential investigation that collects only relevant evidence and limits disclosure to those with a need to know minimizes privacy risk while serving legitimate business interests.

Question 20: Under the Stored Communications Act (SCA), which of the following employer actions would most likely be permissible?

Accessing emails stored on the company's own email server without employee consent (Correct answer)
Accessing an employee's personal Gmail account without consent
Intercepting employee messages on a third-party messaging platform in real time
Compelling a third-party cloud provider to disclose employee personal communications without legal process

Correct answer: Accessing emails stored on the company's own email server without employee consent

The SCA generally permits system operators (including employers) to access communications stored on their own systems, as they are considered an authorized party.

Question 21: A multistate employer must navigate varying state workplace privacy laws. Which of the following is the most prudent compliance strategy?

Adopt the most protective state standard as the baseline policy while documenting state-specific variations where required (Correct answer)
Apply only federal law uniformly across all states to ensure consistency
Create entirely separate HR policies for every state with no cross-reference
Comply only with the state where the corporate headquarters is located

Correct answer: Adopt the most protective state standard as the baseline policy while documenting state-specific variations where required

Adopting the highest common denominator (most protective standard) as a baseline reduces compliance gaps across states while allowing state-specific addenda where local law imposes unique requirements.

CIPP/US Workplace Privacy & Employee Monitoring

Under the Electronic Communications Privacy Act (ECPA), which exception most commonly allows employers to monitor employee email on company systems?

🃏 CIPP US Flashcards — Study This Quiz as Flip Cards →

📚 Want to go deeper? Read the Full CIPP US Study Guide →

What Practice Test Geeks adds beyond an AI chat for CIPP/US

An AI chatbot can quiz you, but it can't reproduce the exam conditions or keep your record. Here you get:

A timed, full-length CIPP/US mock exam — 90 questions in 150 minutes with a 70% pass mark, modeled on the official exam's question count and time limit, followed by a score report broken down by exam domain.
A fixed CIPP/US question bank: the same test every attempt, so your score is comparable from one try to the next instead of changing with every regenerated quiz.
Progress saved on your device: completed tests, scores and missed questions stay in My Progress, so you can retake only what you got wrong.
A printable CIPP/US cheat sheet you can print or save as a PDF.
CIPP/US flashcards built from the same question bank.

Start the Timed CIPP/US Mock Exam →

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

assets.contentstack.io — Retake policy, score release, exam information · verified Nov 2026
iapp.org — Registration deadline, score validity, passing score, registration, test dates · verified Oct 2026
store.iapp.org — Test delivery, fees · verified Oct 2026
pages.iapp.org — Exam format · verified Oct 2026