Exam CIPP-US topic 1 question 3 discussion

For enforcement under Section 5 of the FTC Act or state UDAP laws, self-regulation only occurs at the quasi-legislative stage (i.e., voluntary industry rulemaking). A company writes its own privacy policy, or an industry group drafts a code of conduct that companies agree to follow. Under Section 5, the FTC can then decide whether to bring an enforcement action, and adjudication can occur in front of an ALJ, with appeal to federal court. The NAI(self-regulation) publishes a code of conduct that contains detailed requirements describing how its members must provide notice of their privacy practices separation-of-powers components: legislation, enforcement and adjudication. Enforcement refers to the question of who should initiate enforcement actions. Adjudication refers to the question of who should decide whether a company has violated the privacy rules, and with what penalties

Definitely C

See IAPP book, Section 3.10, paragraph 2.