Us Privacy Federal

US Federal Privacy Landscape

Overview

The United States does not have a single comprehensive federal data protection law equivalent to the GDPR. Instead, the US employs a sectoral approach, with federal laws addressing privacy in specific contexts: health care (HIPAA), financial services (GLBA), children's online data (COPPA), education (FERPA), consumer reporting (FCRA), electronic communications (ECPA), and video rental records (VPPA). The Federal Trade Commission (FTC) exercises broad privacy enforcement authority under Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices. This patchwork creates a complex compliance landscape that requires mapping federal obligations alongside the growing number of state comprehensive privacy laws.

Federal Sectoral Privacy Laws

Health Insurance Portability and Accountability Act (HIPAA)

• Statute: Pub. L. 104-191 (1996); HITECH Act, Pub. L. 111-5 (2009)
• Regulations: 45 CFR Parts 160, 162, 164
• Scope: Covered entities (health plans, health care clearinghouses, health care providers who transmit health information electronically) and their business associates
• Key Requirements:
  • Privacy Rule (45 CFR 164 Subpart E): use and disclosure limitations for Protected Health Information (PHI)
  • Security Rule (45 CFR 164 Subpart C): administrative, physical, and technical safeguards for ePHI
  • Breach Notification Rule (45 CFR 164 Subpart D): notification to individuals, HHS, and media for breaches of unsecured PHI
  • Individual rights: access, amendment, accounting of disclosures, restriction requests
• Enforcement: HHS Office for Civil Rights (OCR); state attorneys general
• Penalties: Up to USD 2,067,813 per violation per calendar year (2024 adjusted); criminal penalties up to USD 250,000 and 10 years imprisonment

Gramm-Leach-Bliley Act (GLBA)

• Statute: Pub. L. 106-102 (1999)
• Regulations: Regulation P (12 CFR 1016); FTC Safeguards Rule (16 CFR 314)
• Scope: Financial institutions — broadly defined to include entities significantly engaged in financial activities (banks, insurance companies, securities firms, but also tax preparers, auto dealers offering financing, etc.)
• Key Requirements:
  • Financial Privacy Rule: notice of privacy practices and opt-out for sharing with non-affiliated third parties
  • Safeguards Rule: comprehensive information security programme with risk assessment, access controls, encryption, multi-factor authentication, incident response
  • Pretexting protections: prohibition on obtaining customer information through false pretences
• Enforcement: Prudential regulators (OCC, Fed, FDIC, NCUA), FTC, state insurance regulators, SEC, CFTC
• 2023 Amendments: FTC Safeguards Rule substantially updated effective June 2023 — mandatory encryption, MFA, CISO designation, written incident response plan, periodic penetration testing

Family Educational Rights and Privacy Act (FERPA)

• Statute: 20 U.S.C. 1232g; 34 CFR Part 99
• Scope: Educational agencies and institutions receiving federal funding
• Key Requirements:
  • Parents (or eligible students over 18) have the right to access education records and request amendments
  • Written consent required before disclosure of personally identifiable information from education records, with exceptions (directory information, legitimate educational interest, health/safety emergency, judicial order)
  • Annual notification of rights
• Enforcement: US Department of Education, Family Policy Compliance Office
• Penalties: Withdrawal of federal funding (in practice, compliance agreements and corrective action)

Children's Online Privacy Protection Act (COPPA)

• Statute: 15 U.S.C. 6501-6506 (1998)
• Regulations: 16 CFR Part 312 (COPPA Rule)
• Scope: Operators of commercial websites and online services directed to children under 13, or that have actual knowledge of collecting personal information from children under 13
• Key Requirements:
  • Verifiable parental consent before collecting personal information from children
  • Clear privacy notice describing information practices
  • Parents' rights: review, delete, refuse further collection
  • Reasonable security measures
  • Data retention limitations
• Enforcement: FTC; state attorneys general
• Penalties: Up to USD 50,120 per violation (2024 adjusted)

Fair Credit Reporting Act (FCRA)

• Statute: 15 U.S.C. 1681 et seq. (1970, amended by FACTA 2003)
• Scope: Consumer reporting agencies, users of consumer reports, furnishers of information
• Key Requirements:
  • Permissible purpose required to obtain consumer reports (credit, employment, insurance, government benefit, legitimate business need)
  • Accuracy obligations for furnishers
  • Consumer rights: free annual report, dispute inaccurate information, fraud alerts, credit freezes
  • Adverse action notices when consumer report information is used against the consumer
• Enforcement: CFPB, FTC, state attorneys general
• Private Right of Action: Yes — statutory damages, actual damages, attorney's fees

Electronic Communications Privacy Act (ECPA)

• Statute: 18 U.S.C. 2510-2522 (Wiretap Act), 18 U.S.C. 2701-2712 (Stored Communications Act), 18 U.S.C. 3121-3127 (Pen Register Act)
• Scope: Interception of electronic communications, access to stored electronic communications, pen register and trap-and-trace devices
• Key Requirements:
  • Wiretap Act: prohibits intentional interception of wire, oral, or electronic communications (with consent and law enforcement exceptions)
  • Stored Communications Act: protects stored electronic communications from unauthorised access; governs law enforcement access
  • Pen Register Act: regulates real-time collection of metadata
• Enforcement: DOJ (criminal); private right of action (Wiretap Act and SCA)