In today’s time, the quantity and exchange of data is more prevalent than ever. In 2017, IBM had stated that over 90% of the world’s data was created in the last two years. And with increasingly advanced technology capabilities to obtain and use that data, this data is more valuable than ever. What laws protect you and your data, and what can you do once you have your data leaked? This article will provide the relevant laws to data protection, and what you as a web user can do to prevent the unnecessary transfer of your personal data.
What Is “Data”?
Data is compiled information. It can range anywhere from extremely sensitive information such as one’s social security number, health records, and finances, to innocuous information, such as company sales, or a city’s demographics.
With the global adoption of the Internet, companies have become more sophisticated in obtaining information. For example, company can record – and exchange – the data stored on its website so that its users do not need to enter in their login information every time they visit a website, or enter in their credit card information every time they make an online purchase. Collecting information of an online user’s activities is called using “
cookies”. The ubiquitous use of cookies, along with many other kinds of exchanged electronic data, has made data privacy more important than ever.
What Laws Protect My Data?
Most countries, including the United States, have instituted laws to regulate data collection, data privacy, transfer of data, consent to use personal data, and what to do in the event of data breaches. Some countries have passed single laws that comprehensively address all of these issues, such as the European Union’s General Data Protection Regulation (“GDPR”). Other countries, such as the United States, have several different laws that regulate different kinds of data.
Kinds of Data Protected
Federal U.S. law prohibits the disclosure and transfer of sensitive information, such as information associated with, for example, motorists (Driver’s Privacy Protection Act of 1994, 18 U.S.C. §§ 2721 et seq.), health (Health Information Portability and Accountability Act (HIPAA), 29 U.S.C. §§ 1181 et seq.), phone calls and phone information (Telephone Consumer Protection Act, 47 U.S.C. § 227), and finances (Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6802 et seq.; Fair Credit Reporting Act/Fair and Accurate Credit Transactions Act, 15 U.S.C. § 1681).
State laws, such as those found in Massachusetts, California, and New York, can add another layer of protection of data. Certain kinds of data are overseen by differing regulatory bodies both at the federal and state levels.
Data Security Measures and Data Breach Laws
The largest federal regulatory body in the online context is the Federal Trade Commission (“FTC”). Under the Federal Trade Commission Act (15 U.S.C. §§ 41 et seq.), the FTC monitors websites to see whether companies are complying with the online privacy statements that are published on those websites, or if the companies are misrepresenting their level of data privacy. As such, the FTC mandates that companies take “reasonable” data security measures to protect a consumer’s personal data.
At the state level, as of 2018, all 50 states, Washington D.C., Guam, Puerto Rico, and the U.S. Virgin Islands have statutes that require companies to report data breaches to impacted individuals. The specifics of what kind of sensitive information is subject to these laws, when a company is required to disclose the breach, and the potential penalties that a company may have for a breach all vary from state to state. In addition to federal regulatory bodies, State Attorneys General offices are often the governing authority that enforces data breach laws.
Transfer/Sharing of Data
Aside from the specific kinds of personal data described above, the United States does not place restrictions on the transfer of data to other jurisdictions. If a company uses and/or transfers your personal data for any reason (nearly every single company does), then the how, when, and why of such data use or data transfer would be explained in the website’s Privacy Policy and/or Terms & Conditions. An example website term & condition is: if a user uses a website, then the user agrees and consents to the company collecting and sharing any information gained from the user’s use of the website.
Specific Online Data Laws
Because of the lack of restrictions pertaining to acquiring and sharing of data, a user often has little power over how his or her data is to be used once on a website. Only very few states, require, for example, companies to disclose how cookies are used to collect information about a consumer’s online activities.
Moreover, only California’s Consumer Privacy Act (“CCPA”), which became effective on January 1, 2020, requires companies to disclose what kinds of data are collected, the commercial purpose of that data, and the categories of third-parties with whom the data is shared. California residents can also request access to their collected information, make demands upon companies to delete such collected information, and institute a private right of action for a violation of the CCPA. Although California is currently the only state to have such a privacy law, New York, Pennsylvania, Minnesota, and Massachusetts have similar privacy laws pending. Visit the
International Association of Privacy Professionals
for an overview of privacy laws in your state.
The recent enactment of the CCPA has benefitted users both residing in and outside of California. Although non-California residents may not have some of the added rights, websites have been forced to change their data-driven business models and update their privacy policies to comply with the CCPA, even though the website is used by residents of from all over the world. Likewise, the European Union’s GDPR has caused United States companies to update their data policies due to the international transfer of data. In fact, the GDPR is the reason why most companies now have disclaimers on the bottom of their websites pertaining to cookies, even though many U.S. states do not have laws requiring such disclaimers.
What Can Be Done?
While only specific kinds of sensitive data, such as health or financial records, are protected by law, users remain at the mercy of a company’s discretion as to how a company uses their personal data. But that does not mean users are at a complete loss. There are ways that to curb the spreading of data. Deleting cookies, using web browser “no-tracking” capabilities, and other tech-savvy techniques to limit the spread of data.
Nevertheless, improper data transfers and data breaches will continue to occur in today’s Information Age. If you believe your sensitive data has been improperly handled, contact a lawyer to navigate the jurisdiction-sensitive laws on your behalf.
DISCLAIMER
The information on this website is for general information purposes only. Nothing on this site should be taken as legal advice for any individual case or situation. This information is not intended to create, and in no way constitutes, an attorney-client relationship.