Introduction to privacy regulations in USA

The Privacy Act of 1974

The Privacy Act of 1974 is a federal law that protects the privacy of individuals' personal information collected by the federal government. The law applies to all federal agencies, including the Department of Justice.

The Privacy Act gives individuals the following rights:

• To be informed of what information the government has about them: Individuals have the right to request from a federal agency a copy of any record that the agency maintains about them.
• To request access to their personal information: Individuals have the right to inspect and copy their records, with some exceptions.
• To correct any inaccurate or incomplete information: Individuals have the right to request that a federal agency correct any inaccurate or incomplete information in their records.
• To have their information destroyed: Individuals have the right to request that a federal agency destroy their records, with some exceptions.
• To file a complaint with the government if they believe their privacy rights have been violated: Individuals have the right to file a complaint with the U.S. Office of Management and Budget if they believe their privacy rights have been violated.

The Privacy Act also requires federal agencies to:

• Collect personal information only for specific, legitimate purposes: Federal agencies may only collect personal information that is relevant and necessary for a specific purpose.
• Use personal information only for those purposes: Federal agencies may only use personal information for the purpose for which it was collected.
• Protect personal information from unauthorized access, use, or disclosure: Federal agencies must take reasonable steps to protect personal information from unauthorized access, use, or disclosure.
• Retain personal information only as long as necessary: Federal agencies must retain personal information only as long as it is necessary for the purpose for which it was collected.

The Privacy Act is an important law that helps to protect the privacy of individuals' personal information. It does this by giving individuals certain rights and by requiring federal agencies to follow certain procedures when collecting and using personal information.

The Privacy Act applies to all types of personal information that is collected by the government, including names, addresses, Social Security numbers, and medical records. However, there are some exceptions to the law, such as information that is collected for national security purposes.

Comparison with GDPR

• Scope
  • The PA applies to federal government agencies and contractors that handle personal information about US citizens or lawful permanent residents. The GDPR applies to any organization that processes the personal data of EU residents, regardless of the organization's location.
• Individual rights
  • Under the PA, individuals have the right to access their personal information held by federal agencies, to request corrections to inaccurate information, and to object to certain uses of their information. Under the GDPR, individuals have a broader range of rights, including the right to be forgotten, the right to data portability, and the right to object to automated decision-making.
• Consent
  • The PA does not explicitly require consent for the collection and processing of personal information. However, the GDPR requires organizations to obtain explicit consent from individuals before collecting or processing their personal data.
• Enforcement
  • The PA is enforced by the Office of Management and Budget (OMB) and the Office of Privacy and Civil Liberties (OPCL) within the Department of Justice. The GDPR is enforced by data protection authorities (DPAs) in each EU member state.
• Penalties
  • The PA provides for civil penalties of up to $5,000 for violations. The GDPR provides for significantly higher penalties of up to 4% of annual global turnover or €20 million, whichever is greater.
• Overall
  • The GDPR is a more comprehensive and stringent data privacy law than the PA. It provides individuals with a broader range of rights and imposes stricter requirements on organizations that process personal data.

Feature	Privacy Act of 1974	GDPR
Scope	US federal government agencies and contractors	Any organization that processes the personal data of EU residents
Individual rights	Access, correction, objection	Access, correction, deletion, portability, objection, no automated decision-making
Consent	Not explicitly required	Explicitly required
Enforcement	OMB, OPCL	DPAs in EU member states
Penalties	Up to $5,000	Up to 4% of annual global turnover or €20 million, whichever is greater

The Family Educational Rights and Privacy Act (FERPA)

• FERPA is a federal law that protects the privacy of student records held by educational institutions that receive federal funding.

• Parents of students under 18 have the right to:

  • Inspect and review their child's education records.
  • Request that the school correct any inaccurate or misleading information in their child's records.
  • Restrict the disclosure of information from their child's records.

• Students who are 18 years old or older have the same rights as parents.

• Schools can disclose information from student records without parental consent or student authorization in certain limited circumstances, such as:

  • To school officials who have a legitimate educational interest in the information.
  • To other schools that the student is transferring to.
  • To the government, if required by law.
  • To organizations providing services to the school, such as the school nurse or the school psychologist.

• Students have the right to file a complaint with the Department of Education if they believe their FERPA rights have been violated.

FERPA is an important law that helps to protect the privacy of student records. It gives parents and students the right to access and control their educational records, and it limits the circumstances in which schools can disclose information from those records.

Here are some additional things to keep in mind about FERPA:

• FERPA applies to all schools that receive federal funding, including public schools, private schools, and colleges and universities.
• FERPA does not apply to records that are kept by law enforcement agencies or by the courts.
• FERPA does not apply to records that are kept by parents or guardians.

Comparison with GDPR

• Scope
  • FERPA applies to educational institutions that receive funding from the US Department of Education. This includes public elementary schools, secondary schools, and postsecondary institutions. The GDPR applies to any organization that processes the personal data of EU residents, regardless of the organization's location.
• Individual rights
  • Under FERPA, students have the right to inspect and review their education records, to request corrections to inaccurate information, and to consent to the disclosure of their education records to third parties. Under the GDPR, individuals have a broader range of rights, including the right to be forgotten, the right to data portability, and the right to object to automated decision-making.
• Consent
  • FERPA does not require consent for the collection and processing of student education records. However, the GDPR requires organizations to obtain explicit consent from individuals before collecting or processing their personal data.
• Enforcement
  • FERPA is enforced by the US Department of Education. The GDPR is enforced by data protection authorities (DPAs) in each EU member state.
• Penalties
  • FERPA provides for civil penalties of up to $5,000 and suspension or termination of federal funding for violations. The GDPR provides for significantly higher penalties of up to 4% of annual global turnover or €20 million, whichever is greater.
• Overall
  • The GDPR is a more comprehensive and stringent data privacy law than FERPA. It provides individuals with a broader range of rights and imposes stricter requirements on organizations that process personal data.

Feature	FERPA	GDPR
Scope	US educational institutions that receive federal funding	Any organization that processes the personal data of EU residents
Individual rights	Access, correction, consent	Access, correction, deletion, portability, objection, no automated decision-making
Consent	Not required	Explicitly required
Enforcement	US Department of Education	DPAs in EU member states
Penalties	Up to $5,000 and suspension or termination of federal funding	Up to 4% of annual global turnover or €20 million, whichever is greater

The Health Insurance Portability and Accountability Act (HIPAA)

• HIPAA is a federal law that protects the privacy and security of health information.

• It applies to health care providers, health plans, and health care clearinghouses.

• HIPAA gives individuals the right to:

  • Inspect and copy their health information.
  • Request that their health information be corrected.
  • Restrict the disclosure of their health information.

• HIPAA also requires health care providers to:

  • Protect health information from unauthorized access, use, or disclosure.
  • Implement security measures to protect health information.

Here are some of the key provisions of HIPAA:

• Privacy Rule: This rule sets national standards for the protection of individuals' health information. It requires health care providers to obtain patient consent before disclosing their health information, except in certain limited circumstances.

• Security Rule: This rule sets national standards for the security of electronic health information. It requires health care providers to implement appropriate security measures to protect health information from unauthorized access, use, or disclosure.

• Transactions and Code Sets Rule: This rule standardizes the electronic exchange of health information. It requires health care providers to use standard codes and formats when transmitting health information electronically.

• Unique Identifiers Rule: This rule establishes national standards for unique identifiers for health care providers, health plans, and individuals. These identifiers are used to track health information and to prevent fraud and abuse.

• Enforcement Rule: This rule establishes the procedures for enforcing HIPAA. It allows the Department of Health and Human Services (HHS) to impose civil and criminal penalties on organizations that violate HIPAA.

HIPAA is an important law that helps to protect the privacy and security of health information. It gives individuals control over their health information and it helps to ensure that health information is used only for its intended purposes.

If you have any questions about HIPAA, you can contact the HHS Office for Civil Rights. You can also find more information about HIPAA on the HHS website.

Here are some additional things to keep in mind about HIPAA:

• HIPAA applies to all health care providers, including doctors, hospitals, and insurance companies.
• HIPAA does not apply to information that is not considered health information, such as your name, address, or date of birth.
• HIPAA does not apply to information that is de-identified, meaning that it does not contain any information that could be used to identify you.

Comparison With GDPR

• Scope
  • HIPAA applies to healthcare providers, health insurers, and other healthcare-related entities in the United States. The GDPR applies to any organization that processes the personal data of EU residents, regardless of the organization's location.
• Individual rights
  • Under HIPAA, individuals have the right to access their PHI, to request corrections to inaccurate information, and to restrict the disclosure of their PHI to certain third parties. Under the GDPR, individuals have a broader range of rights, including the right to be forgotten, the right to data portability, and the right to object to automated decision-making.
• Consent
  • HIPAA does not require explicit consent for the collection and processing of PHI for treatment, payment, and healthcare operations. However, the GDPR requires organizations to obtain explicit consent from individuals before collecting or processing their personal data.
• Enforcement
  • HIPAA is enforced by the US Department of Health and Human Services (HHS). The GDPR is enforced by data protection authorities (DPAs) in each EU member state.
• Penalties
  • HIPAA provides for civil penalties of up to $50,000 per violation and criminal penalties of up to 10 years in prison for certain violations. The GDPR provides for significantly higher penalties of up to 4% of annual global turnover or €20 million, whichever is greater.

Feature	HIPAA	GDPR
Scope	Healthcare providers, health insurers, and other healthcare-related entities in the United States	Any organization that processes the personal data of EU residents
Individual rights	Access, correction, restriction of disclosure	Access, correction, deletion, portability, objection, no automated decision-making
Consent	Not required for treatment, payment, and healthcare operations	Explicitly required
Enforcement	US Department of Health and Human Services (HHS)	Data protection authorities (DPAs) in each EU member state
Penalties	Up to $50,000 per violation and/or up to 10 years in prison	Up to 4% of annual global turnover or €20 million, whichever is greater

The Gramm-Leach-Bliley Act (GLBA)

• The Gramm-Leach-Bliley Act (GLBA) is a federal law that was enacted in 1999.
• The GLBA was passed to reform the financial services industry and to create a more competitive environment.
• The GLBA also includes provisions that protect the privacy of consumers' financial information.

The GLBA consists of three main parts:

• The Financial Privacy Rule: This rule requires financial institutions to provide consumers with a privacy notice that explains how the institution collects, uses, and shares their personal financial information.
• The Safeguards Rule: This rule requires financial institutions to implement security measures to protect consumers' personal financial information from unauthorized access, use, or disclosure.
• The Pretexting Provisions: These provisions prohibit the practice of pretexting, which is obtaining someone's personal financial information by false pretenses.

The GLBA applies to all financial institutions that offer financial products or services to consumers, such as banks, credit unions, securities firms, insurance companies, and mortgage lenders.

The GLBA gives consumers the following rights:

• The right to receive a privacy notice from their financial institution.
• The right to opt out of certain disclosures of their personal financial information.
• The right to access and correct their personal financial information.
• The right to file a complaint with the Federal Trade Commission (FTC) if they believe their privacy rights have been violated.

The GLBA is an important law that helps to protect the privacy of consumers' financial information. It gives consumers control over their personal financial information and it helps to ensure that financial institutions are responsible with how they collect, use, and share that information.

If you have any questions about the GLBA, you can contact the FTC. You can also find more information about the GLBA on the FTC's website.

Here are some additional things to keep in mind about the GLBA:

• The GLBA does not apply to all businesses that collect personal financial information.
• The GLBA does not apply to information that is not considered personal financial information, such as your name, address, or date of birth.
• The GLBA does not apply to information that is de-identified, meaning that it does not contain any information that could be used to identify you.

Comparison with GDPR

• Scope
  • The GLBA applies to financial institutions in the United States, such as banks, credit unions, and investment firms. The GDPR applies to any organization that processes the personal data of EU residents, regardless of the organization's location.
• Individual rights
  • Under the GLBA, consumers have the right to access their financial information, to request corrections to inaccurate information, and to opt out of the sharing of their information with third parties. Under the GDPR, individuals have a broader range of rights, including the right to be forgotten, the right to data portability, and the right to object to automated decision-making.
• Consent
  • The GLBA does not require explicit consent for the collection and sharing of financial information. However, the GDPR requires organizations to obtain explicit consent from individuals before collecting or processing their personal data.
• Enforcement
  • The GLBA is enforced by a variety of federal and state agencies, including the Federal Trade Commission (FTC), the Consumer Financial Protection Bureau (CFPB), and bank regulators. The GDPR is enforced by data protection authorities (DPAs) in each EU member state.
• Penalties
  • The GLBA provides for civil penalties of up to $100,000 per violation. The GDPR provides for significantly higher penalties of up to 4% of annual global turnover or €20 million, whichever is greater.
• Overall
  • The GDPR is a more comprehensive and stringent data privacy law than the GLBA. It provides individuals with a broader range of rights and imposes stricter requirements on organizations that process personal data.

Feature	GLBA	GDPR
Scope	Financial institutions in the United States	Any organization that processes the personal data of EU residents
Individual rights	Access, correction, opt-out	Access, correction, deletion, portability, objection, no automated decision-making
Consent	Not required	Explicitly required
Enforcement	Federal and state agencies	Data protection authorities (DPAs) in each EU member state
Penalties	Up to $100,000 per violation	Up to 4% of annual global turnover or €20 million, whichever is greater

The Children's Online Privacy Protection Act (COPPA)

• COPPA is a federal law that protects the privacy of children under the age of 13.
• It was passed in 1998 and went into effect in 2000.
• COPPA applies to websites and online services that collect personal information from children under 13.
• Personal information is information that can be used to identify a child, such as their name, address, phone number, or email address.

COPPA requires websites and online services that collect personal information from children under 13 to:

• Get parental consent before collecting or using the child's personal information.
• Provide parents with notice of their privacy practices.
• Allow parents to review their child's personal information and to delete it.
• Not collect personal information from children under 13 without parental consent for certain activities, such as targeted advertising.

COPPA is enforced by the Federal Trade Commission (FTC). The FTC can impose civil penalties on websites and online services that violate COPPA.

COPPA is an important law that helps to protect the privacy of children online. It gives parents control over their children's personal information and it helps to ensure that websites and online services are responsible with how they collect and use that information.

Here are some additional things to keep in mind about COPPA:

• COPPA does not apply to websites and online services that are directed to adults only.
• COPPA does not apply to websites and online services that do not collect personal information from children under 13.
• COPPA does not apply to websites and online services that collect personal information from children under 13 but do not use it for commercial purposes.

Comparison with GDPR

• Scope
  • COPPA applies to operators of websites and online services that are directed to children under the age of 13, or who have actual knowledge that they are collecting personal information from children under the age of 13. The GDPR applies to any organization that processes the personal data of EU residents, regardless of the organization's location.
• Age of consent
  • COPPA sets the age of consent for the collection and processing of children's personal information at 13 years old. The GDPR sets the age of consent at 16 years old, but allows individual member states to lower the age of consent to a minimum of 13 years old.
• Parental consent
  • COPPA requires operators of websites and online services to obtain parental consent before collecting, using, or disclosing personal information from children under the age of 13. The GDPR also requires organizations to obtain consent from parents or guardians before processing the personal data of children under the age of 16. However, the GDPR allows member states to provide for exceptions to this requirement, such as when the processing is necessary for the protection of the vital interests of the child.
• Individual rights
  • Under COPPA, parents have the right to access their children's personal information, to request corrections to inaccurate information, and to have their children's personal information deleted. Under the GDPR, children have the same rights as adults, including the right to access their personal data, to request corrections to inaccurate information, and to have their personal data deleted.
• Enforcement
  • COPPA is enforced by the Federal Trade Commission (FTC). The GDPR is enforced by data protection authorities (DPAs) in each EU member state.
• Penalties
  • COPPA provides for civil penalties of up to $46,517 per violation. The GDPR provides for significantly higher penalties of up to 4% of annual global turnover or €20 million, whichever is greater.
• Overall
  • The GDPR is a more comprehensive and stringent data privacy law than COPPA. It provides children with the same rights as adults and imposes stricter requirements on organizations that process the personal data of children.

Feature	COPPA	GDPR
Scope	Operators of websites and online services that are directed to children under the age of 13	Any organization that processes the personal data of EU residents
Age of consent	13 years old	16 years old (but member states can lower this to 13 years old)
Parental consent	Required for children under the age of 13	Required for children under the age of 16, but member states can provide for exceptions
Individual rights	Parents have the right to access their children's personal information, to request corrections to inaccurate information, and to have their children's personal information deleted.	Children have the same rights as adults, including the right to access their personal data, to request corrections to inaccurate information, and to have their personal data deleted.
Enforcement	Federal Trade Commission (FTC)	Data protection authorities (DPAs) in each EU member state
Penalties	Up to $46,517 per violation	Up to 4% of annual global turnover or €20 million, whichever is greater