# B. Compliance under the US Data Privacy Regime

The United States data privacy regime lacks a comprehensive law that regulates the collection and processing of personal data of U.S. residents by private parties. While there are constraints against government information collection through both the Federal Constitution and an extensive statutory framework regulating government use of personal data, there is no similar broad federal regulatory privacy law regulating private parties. Instead, the current data privacy framework arises out of a patchwork of federal and state laws, many of which are focused on a particular sector of the economy. By focusing the law on particular areas of concern, the United States has effectively chosen business freedom as a key principle in the area. Outside specified areas, the focus is limited to enforcing the privacy promises that businesses make to users, rather than on specific mandates setting out what businesses can and cannot do with data. Sectoral laws include the Health Insurance Portability and Accountability Act (HIPAA), covering the health industry, and the Gramm-Leach-Bliley Act (GLBA), covering the financial sector. In addition, the Federal Trade Commission Act (FTCA) gives the Federal Trade Commission broad authority to regulate data practices if they constitute “unfair or deceptive acts or practices in or affecting commerce.”<sup>19</sup> Through the FTCA, the Federal Trade Commission serves as the nation’s de facto privacy regulator, and its settlements create a kind of common law of privacy.<sup>20</sup> HIPAA imposes an extensive set of privacy protections for personal health data gathered by covered entities, including hospitals, health care providers, and health insurers. Not only must health plans and health care providers give patients a written notice of their privacy practices, they must also “maintain reasonable and appropriate administrative, physical, and technical safeguards to ensure the integrity and confidentiality of the information, and to protect against any reasonably anticipated threats.”<sup>21</sup> These safeguards include designating a privacy official, training employees, and developing a system of sanctions for employees who violate the entity’s policies.<sup>22</sup> HIPAA also mandates the Department of Health and Human Services (DHHS) to “adopt security standards that take into account the technical capabilities of record systems used to maintain health information, the costs of security measures, and the value of audit trails in computerized record.”<sup>23</sup> There is extensive rulemaking elaborating the statute.

The GLBA (also known as the Financial Modernization Act) regulates the use of nonpublic personal information by institutions or businesses engaged in financial activities such as banks, insurers, and brokerage firms. The GLBA empowers the Federal Trade Commission (FTC) to enforce the “obligations that establish standards for financial institutions relating to administrative, technical, and physical information safeguards.”<sup>24</sup> Covered entities are obligated to protect any “personal information collected about an individual in connection with providing a financial product or service, unless that information is otherwise publicly available.”<sup>25</sup> California’s Consumer Privacy Act (CCPA), which went into effect at the beginning of 2020, will have significant impact, especially on larger enterprises. The nation’s first comprehensive privacy law regulating commercial enterprise, the CCPA has a broad reach outside of California, covering all companies that do business in California and either (1) have an annual gross global revenue in excess of $25 million, (2) handle the personal information of at least 50,000 California residents, or (3) derive

> 19 Fed. Trade Comm’n Act, 15 U.S.C. § 5 (2006)

> 20 <mark>Daniel J. Solove & Woodrow Hartzog,</mark> _<mark>The FTC and the New Common Law of Privacy</mark>_ <mark>, 114 COLUM. L. REV. 583 (2013).</mark>

> 21 C. Stephen Redhead, RS20500, _Medical Records Privacy: Questions and Answers on the HIPAA Rule_ 6 (Cong. Research Serv. 2004).

> 22 _Id._

> 23 Pub. L. No. 104-191, tit. IV, <mark>§§ 261-264,</mark> 110 Stat. 1936 (1996).

> 24 Pub. L. No. 106-102, tit. V, <mark>Subtitle A, 113 Stat. 1338 (1999).</mark>

> 25 _Id_ .

5