2.1 Branches of Government and Their Privacy Roles

2.1 Branches of Government and Their Privacy Roles

The IAPP CIPP/US Body of Knowledge 2.6.1 (effective 1 September 2025) opens Domain I with a deceptively simple performance indicator: identify the branches of government and know their roles and functions. Domain I as a whole is 27–33 of the exam's 90 questions; competency I.A itself is only 3–5 items. Those few items are still high-leverage, because later questions about the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Gramm-Leach-Bliley Act (GLBA), or a state comprehensive privacy law all collapse if you assign the wrong branch the power to write, enforce, or interpret the rule.

The three branches, in privacy terms

The legislative branch is Congress and the 50 state legislatures. Its privacy product is the statute. A federal privacy bill becomes binding law only after bicameral passage (House and Senate agree on the same text) and presentment to the President, who signs it or whose veto is overridden by a two-thirds vote in each chamber. The enacted text is then codified in the United States Code. Statutes do the heavy structural work: they create agencies, authorize rulemaking, define who is covered, decide whether individuals may sue, and set preemption language. Domain II statutes you will meet later — the Federal Trade Commission Act (FTC Act), HIPAA, GLBA, the Fair Credit Reporting Act (FCRA), the Children's Online Privacy Protection Act (COPPA), and the Telephone Consumer Protection Act (TCPA) — are all legislative-branch instruments.

The executive branch includes the President, Cabinet departments, and independent agencies. It enforces statutes, and it issues regulations and rules when Congress delegated that power. The President may also issue executive orders that bind federal agencies and federal contractors. Privacy-relevant executive actors include the Federal Trade Commission (FTC), the Federal Communications Commission (FCC), the Department of Health and Human Services (HHS) and its Office for Civil Rights (OCR), the Department of Commerce, the federal banking agencies, and the Consumer Financial Protection Bureau (CFPB). When the exam asks who issues a rule, who investigates, or who enters a consent order, the answer lives here.

The judicial branch is the federal and state courts. Courts interpret statutes and regulations, develop case law and common law, issue injunctions, award damages when a private right of action exists, and decide constitutionality. After Loper Bright Enterprises v. Raimondo (2024), federal courts exercise independent judgment when reading a statute. They no longer apply Chevron deference to an agency's interpretation. An agency reading may still be persuasive, but the court, not the agency, says what the statute means. That is the modern exam-safe answer to "which branch interprets."

How a privacy bill becomes a statute

Walk the federal path in order, because the exam likes to stop you in the middle. A member introduces a bill. A committee holds hearings and may report a substitute. Each chamber must pass the bill. If the texts differ, a conference committee or an amendment exchange produces one enrolled text. Only then does presentment occur. Signature — or a successful veto override — creates a statute. Implementing regulations come later, through the Administrative Procedure Act (APA) notice-and-comment process in 5 U.S.C. § 553, unless Congress specified a different procedure.

Committee report language, a floor speech, a White House fact sheet, and an agency press release are not the statute. An agency rule is not the statute. An FTC consent order is not the statute. If two sources conflict, start with the enacted text, then the valid regulation, then nonbinding guidance.

How an FTC consent order works

The FTC's own enforcement-authority overview (revised July 2025) is the official description to memorize. Section 5(a) of the FTC Act declares unfair or deceptive acts or practices in or affecting commerce unlawful. Deceptive practices involve a material representation, omission, or practice likely to mislead a reasonable consumer. An act is unfair if it causes or is likely to cause substantial injury that consumers cannot reasonably avoid and that is not outweighed by countervailing benefits to consumers or competition (15 U.S.C. § 45(n)).

A typical consumer-protection investigation is non-public. The Bureau of Consumer Protection uses civil investigative demands (CIDs), not Section 9 subpoenas, to obtain documents, testimony, and written answers. The Commission may proceed only if it has "reason to believe" a violation occurred and a proceeding would be in the public interest.

If the respondent settles, it typically signs a consent agreement without admitting liability, consents to entry of a final order, and waives judicial review. If the Commission accepts the proposal, it places the order on the public record for thirty days of public comment before deciding whether to make the order final. The resulting administrative consent order binds that respondent. It does not amend Title 15, and a competitor that was never a party cannot be held in contempt of an order it never signed. The competitor remains subject to Section 5 and to any applicable statute or rule.

A second path is a stipulated federal-court order. In the 2019 Facebook matter, the Commission voted to refer a complaint and stipulated order to the Department of Justice for filing in the U.S. District Court for the District of Columbia. The FTC states that stipulated final orders have the force of law when the district judge approves and signs them. Violating a final Commission order can support civil penalties. A first-time Section 5 deception case, standing alone, is not the same thing as a penalty action for violating a rule or a prior order. After AMG Capital Management, LLC v. FTC (2021), the Supreme Court also held that Section 13(b) does not authorize the FTC to obtain equitable monetary relief such as restitution — another reminder that the judicial branch, not the agency, has the last word on what a statute allows.

Worked contrast. Congress debates a children's-privacy bill for two sessions, both chambers pass the same text, and the President signs COPPA. That statute applies to every operator who meets its coverage terms. Years later the FTC investigates one operator, negotiates a twenty-year consent order requiring a comprehensive privacy program, and publishes the proposed order for comment. Rival apps are not parties. They must still obey COPPA and Section 5, but they cannot be sanctioned for "violating" a consent order they never signed.

Executive orders and federalism

An executive order directs the executive branch. It can change how federal agencies collect or share data, or instruct an agency to begin a rulemaking. It does not, by itself, create a private right of action against a private company, and a later President can revoke it. Do not treat an executive order as a substitute for HIPAA, GLBA, or a state comprehensive privacy statute.

The United States is a federal system. The Constitution enumerates federal powers; the Tenth Amendment reserves other powers to the states or the people. Justice Brandeis's dissent in New State Ice Co. v. Liebmann (1932) described states as laboratories that may try novel social and economic experiments without risking the whole nation. Because Congress has not enacted a comprehensive consumer-privacy statute, states have written their own — California's California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), Virginia's Consumer Data Protection Act (CDPA), and the additional state laws coming online in 2026. Those statutes are legislative products. State attorneys general (executive) enforce most of them. State and federal courts (judicial) interpret them and decide preemption fights.

Exam traps

Which branch issues rules, and which interprets them? Agencies issue rules under a statutory delegation. Courts interpret the statute, the rule, and the Constitution. Congress does not "interpret" a statute in a way that binds courts the way an Article III opinion does. The President does not "enact" a statute by executive order.

Worked scenario. Product counsel asks who can "make it illegal" to sell precise geolocation. Lawful answers include a new federal statute, a valid agency rule if Congress delegated that subject, a state comprehensive privacy law if the company is in scope, or a court injunction in a live case. An FTC consent order against a different company does not criminalize the practice for everyone. A White House executive order aimed at federal contractors does not automatically rewrite duties for a retailer that is not a contractor.