Part 4 of John's CIPP/US Privacy Materials
Laws on Government and Court Access to Private-sector Information, BoK III
by John Bandler
This is Part 4 of my U.S. Privacy and CIPP/US and privacy learning materials (aligning with CIPP/US BoK Domain III).
+ This page is greatly updated and mostly comprehensive after a recent revamp in August 2026. +
1. To navigate John's CIPP/US pages
2. Topics covered
Here we cover cover issues relating to privacy from government, including law enforcement and national security roles. We should think about how government gets information or data that it needs, and the CIPP/US focus is how it gets data stored by third parties. We also examine the role of the civil courts to compel the exchange of data.
But to get there, we need to understand some basics on law and the Fourth Amendment, which we will recap (having covered it a little in earlier domains). We will cover the Electronic Communications Privacy Act (ECPA), the Foreign Intelligence Surveillance Act (FISA), and more.
This domain is not highly tested but is important to know, especially if you live in the U.S. This domain essentially covers:
- Law Enforcement and Privacy
- Electronic Communications Privacy Act (ECPA)
- Wiretap Act
- Stored Communications Act (SCA)
- Pen Register Trap and Trace Devices
- The Communications Assistance to Law Enforcement Act (CALEA)
- Privacy Protection Act of 1980
- National Security and Privacy
- Foreign Intelligence Surveillance Act of 1978 (FISA)
- USA-PATRIOT Act: Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001
- The USA Freedom Act of 2015
- The Cybersecurity Information Sharing Act of 2015 (CISA)
- Civil Litigation and Privacy
- Discovery / Disclosure
- E-discovery
We see many issues relating to this in the news almost daily.
By now we have a solid foundation in law and U.S. government which helps us as we navigate the issues relating to the U.S. Constitution and Fourth Amendment, separation of powers and checks and balances, and balancing various needs.
Law enforcement needs the ability to investigate and arrest, but it is limited by the Fourth Amendment. Our national security apparatus needs the ability to spy and counterspy, but that also needs limits. Then, a lawsuit between parties means each side needs information to prepare for trial (known as discovery or disclosure) but that can have privacy implications.
In 2026 the federal government started misstating the law about what it took to arrest an individual, and when a home can be searched. I created a video on the Fourth Amendment to try share some legal knowledge with others.
3. Don't forget the overall references for CIPP/US and my courses
- See my Part 1 webpage for the overall references and additional reading (including IAPP resources)
- My online courses provide priority coverage of important areas, so if you are in my online course, listen to those first.
- I have created two online courses to help people learn about privacy and prepare for this certification exam.
- My Udemy CIPP/US course was originally geared for lawyers and law students, but many non-lawyers have taken it too. It is on the Udemy learning platform, and you can purchase it for under $20, including with my coupon code.
- Another course is geared for information security professionals on the Infosec Skills subscription based learning platform (Infosec Skills was bought by online education behemoth Cengage).
- If you are taking one of my online courses and want to dig deeper into the materials, I provide resources and references here. Prioritize your time, start by learning the basics before digging into the weeds.
- If you are not taking one of my online courses, that's OK too, I hope they help you, and please consider this.
4. Part 4 specific references
- See my Part 1 course for the overall references and additional reading (including IAPP resources, the coursebook, etc.)
- My courses provide priority coverage of important areas. If you want to dig deeper (or are not taking one of my courses) see these resources.
Part 4 prioritization: As always, start with the basics. This part is not heavily tested but it is important for life and being in the U.S. and is in the news a lot. Part 4 is close to my heart, and I have spent a lot of time in it, so keep that in mind as you review the below, so you can prioritize your time. Keep your focus on the solid basics, don't get too far into the details or my additional references or resources.
Key Cyberlaw book parts and chapters relating to this domain include:
- Chapter 11, The Fourth Amendment and government search and seizure, https://johnbandler.com/cyberlawbook-resources-ch11/
- Part 4: “Criminal Cyberlaw:” Cybercrime and Cybercrime Investigations (Chapters 19-23)
- Chapter 21, Criminal Procedure and Gathering Electronic and Cybercrime Evidence, https://johnbandler.com/cyberlawbook-resources-ch21/
- Chapter 35 International cyber conflict and law, https://johnbandler.com/cyberlawbook-resources-ch35/
Topics covered include
- Fourth Amendment
- Law enforcement investigation
- National security investigation
- ECPA: the Electronic Communications Privacy Act
- Wiretap Act
- Stored Communications Act (SCA)
- Pen Registers
- CALEA: the Communications Assistance to Law Enforcement Act
- Privacy Protection Act of 1980
- Right to Financial Privacy Act of 1978
- Bank Secrecy Act of 1970 (BSA)
- Cybersecurity Information Sharing Act (CISA)
- Foreign Intelligence Surveillance Act of 1978 (FISA)
- Foreign Intelligence Surveillance Court (FISC)
- E-discovery
4.1 Fourth Amendment basics
- The Fourth Amendment and Search and Seizure, https://johnbandler.com/fourth-amendment/
- My video on the Fourth Amendment at the bottom of the webpage or at https://youtu.be/xNdZRn2Ah-A
- Fourth Amendment cases things to know, https://johnbandler.com/things-to-know-fourth-amendment-cases/
- Criminal Law, https://johnbandler.com/criminal-law/
- Procedural criminal cyberlaw, https://johnbandler.com/criminal-cyberlaw-procedural/
- Cyberlaw book Chapter 21 resources (Criminal Procedure and Gathering Electronic and Cybercrime Evidence), https://johnbandler.com/cyberlawbook-resources-ch21/
- Cornell LII, Fourth Amendment, https://www.law.cornell.edu/wex/fourth_amendment
- Cyberlaw Chapter 11, The Fourth Amendment and government search and seizure, https://johnbandler.com/cyberlawbook-resources-ch11/
4.2 Fourth Amendment applied to technology, digital data, etc.
- The Fourth Amendment and Search and Seizure, https://johnbandler.com/fourth-amendment/
- Fourth Amendment cases things to know, https://johnbandler.com/things-to-know-fourth-amendment-cases/
- Cyberlaw Chapter 11, The Fourth Amendment and government search and seizure, https://johnbandler.com/cyberlawbook-resources-ch11/
- Cyberlaw Chapter 21, Criminal Procedure and Gathering Electronic and Cybercrime Evidence, https://johnbandler.com/cyberlawbook-resources-ch21/
- Cybercrime Investigations (2020), Chapter 7
- Electronic Communications Privacy Act (ECPA) (see later)
- Katz v. United States , 389 U.S. 347 (1967)
- United States v. Jones, 565 U.S. 400 (2012)
- Riley v. California 573 U.S. 373 (2014)
- Carpenter v. United States 585 U.S. 296 (2018)
4.3 ECPA
Electronic Communications Privacy Act (ECPA) main titles
- Title I: Wiretap Act 18 U.S.C. §§ 2510–2523, https://www.law.cornell.edu/uscode/text/18/part-I/chapter-119
- Title II: Stored Communications Act (SCA) 18 U.S.C. §§ 2701–2713, https://www.law.cornell.edu/uscode/text/18/2713
- Title III: Pen Registers and trap and trace devices 18 U.S.C. §§ 3121–3127, https://www.law.cornell.edu/uscode/text/18/part-II/chapter-206
4.4 Communications Assistance to Law Enforcement Act (CALEA) (“Digital Telephony Bill”)
- 47 U.S. Code Chapter 9 Subchapter I - Interception of Digital and Other Communications (47 USC §1001-1010), https://www.law.cornell.edu/uscode/text/47/chapter-9/subchapter-I
- National Domestic Communications Assistance Center, CALEA, https://ndcac.fbi.gov/calea
- FCC, Communications Assistance for Law Enforcement Act, https://www.fcc.gov/calea
4.5 CLOUD Act
- Clarifying Lawful Overseas Use of Data (CLOUD) Act,
- Also consider
- Underlying case that gave rise to CLOUD Act, United States v. Microsoft Corp., 584 U.S. 236 (2018)
- Mutual Legal Assistance Treaty (MLAT)
- See Cyberlaw (2025) and Cybercrime Investigations (2020)
4.6 Cybersecurity Information Sharing Act (CISA) of 2015
- Feb 2026 – Congress extended through 9/30/2026
- Watch this space and check for updates
- CISA, Cybersecurity Information Sharing Act, 6 U.S. Code Chapter 6 Subchapter I - Cybersecurity Information Sharing, (6 U.S.C. §§ 1500-1510) https://www.law.cornell.edu/uscode/text/6/chapter-6/subchapter-I
- CISA, Cybersecurity and Infrastructure Security Agency, https://www.cisa.gov
- CISA, Privacy and Civil Liberties Guidelines: Cybersecurity Information Sharing Act of 2015, https://www.cisa.gov/resources-tools/resources/privacy-and-civil-liberties-guidelines-cybersecurity-information-sharing-act-2015
4.7 Privacy Protection Act (PPA)
- Note that CIPP/US BoK puts this with III C (Civil litigation) but it really should be within III A (Law enforcement)
- Privacy Protection Act (PPA) of 1980
- Privacy Protection Act (PPA), 42 U.S. Code § 2000aa - Searches and seizures by government officers and employees in connection with investigation or prosecution of criminal offenses, https://www.law.cornell.edu/uscode/text/42/2000aa
- Public law L. 96–440, https://uslaw.link/citation/us-law/public/96/440
- Genesis for PPA is Zurcher v. Stanford Daily, 436 U.S. 547 (1978) (case now moot because of the Privacy Protection Act of 1980)
- US DOJ Justice Manual Archives, Criminal Resource Manual, 661: Privacy Protection Act of 1980, https://www.justice.gov/archives/jm/criminal-resource-manual-661-privacy-protection-act-1980
- Compare PPA law vs actions in FBI/DOJ Search of home and electronic devices of Washington Post reporter Hannah Natanson on 1/14/2026
- Opinion and Order, Matter of Search of Property and Premises of Hannah Natanson, 2/24/2026, USMJ Porter, https://www.rcfp.org/wp-content/uploads/2026/02/2026-02-24-In-re-Natanson-search-Opinion-and-order.pdf
- Reporters Committee for Freedom of the Press v. Office of the Attorney General, https://www.rcfp.org/litigation/rcfp-v-oag-2/
- The Hill, Second judge bars DOJ from searching Washington Post journalist’s devices, 5/5/2026, https://thehill.com/homenews/administration/5863936-judge-bars-doj-search-journalist/ (“U.S. District Judge Anthony J. Trenga condemned the seizure of reporter Hannah Natanson’s devices after her personal belongings were taken in January.”)
- Opinion and Order, Matter of Search of Property and Premises of Hannah Natanson, 5/4/2026, SUSDJ Trenga, https://storage.courtlistener.com/recap/gov.uscourts.vaed.588771/gov.uscourts.vaed.588771.122.0.pdf
4.9 National security, privacy, FISA
International cyber conflict
- International cyber conflict, https://johnbandler.com/cyber-conflict/
- Chapter 35 International cyber conflict and law, https://johnbandler.com/cyberlawbook-resources-ch35/
- Cybercrime Investigations (2020 book), Chapter 8 Cyber Investigations Linked to Nation-States or Terrorists
- UN Charter Article 1 and 2, especially 2(4), https://www.un.org/en/about-us/un-charter/chapter-1
- UN Charter Article 51, https://www.un.org/en/about-us/un-charter/chapter-7
FISA, FISC
- FISA, FISC webpage coming someday here?
- Foreign Intelligence Surveillance Act of 1978 (FISA)
- FISA, Title 50 Chapter 36 of the US Code, https://www.law.cornell.edu/uscode/text/50/chapter-36
- Foreign Intelligence Surveillance Court (FISC), https://www.fisc.uscourts.gov/
- FISC, About the Foreign Intelligence Surveillance Court, https://www.fisc.uscourts.gov/about-foreign-intelligence-surveillance-court
- FISA Amendments Act of 2008 (FISAA): Section 702 (requires periodic extension)
- 2012: Section 702 extended for five years
- 2018: Section 702 extended for six years
- 2024: Section 702 extended for 2 years
- 6/12/2026: Section 702 expired
- Watch this space and check for updates
- Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act)
- Snowden revelations(2013)
- USA FREEDOM Act (2015)
- National Security Letters (NSLs)
Data brokers, PADFAA
- 15 U.S. Code Chapter 123 - Protecting Americans’ Data from Foreign Adversaries, https://www.law.cornell.edu/uscode/text/15/chapter-123
- 15 USC § 9901, Prohibition on transfer of personally identifiable sensitive data of United States individuals to foreign adversaries, https://www.law.cornell.edu/uscode/text/15/9901
4.10 E-discovery
- Discovery, disclosure, civil litigation
- Cyberlaw Chapter 9, Civil law introduced
- Electronic Discovery Reference Model (EDRM), https://edrm.net/
- Current EDRM Model, https://edrm.net/edrm-model/current/
- EDRM, Information Governance Reference Model (IGRM) landing page, https://edrm.net/resources/frameworks-and-standards/information-governance-reference-model/
- IGRM 4.1 Model, https://edrm.net/download/153347/?tmstv=1679659920
- IGRM 4.1 User Guide, https://edrm.net/download/240343/?tmstv=1781118237
5. Conclusion
Remember, don't let the size of this references page intimidate you, and you don't have to visit all the links nor read them all.
I'm just sharing my research for those who want to dive deeper in a particular area.
This lets you start your research where I left off. Do your own research and I don't promise to keep this updated.
This page is hosted at https://johnbandler.com/cippus/part4. Copyright John Bandler, all rights reserved. No claim to IAPP materials or legal references.
Page posted 3/22/2026, drawing upon my previous materials. This page updated 08/11/2026.
These pages will always remain a work-in-progress and I cannot guarantee to keep them accurate or updated. Please contact me if you have an update, suggestion, or correction, and if these free resources helped you, please consider this to give back.

