I have performed significant academic and practical work in the privacy space. The US has a fundamentally different (and, frankly, better) approach to privacy compared to the EU.

The US tends to view privacy, in general, as freedom from unwelcome perception, often construed as "the right to be let alone", following Warren and Brandeis. The EU tend to define privacy as a specific type of control, as "control over how your personal information is collected and used." More recently, the terms "information privacy" or "data privacy" is used to reflect the European approach [1]. I personally detest calling the European approach "privacy" in any manner; it's just data control, plain and simple.

Freedom and control are both related to the expression of free will, yet their outcomes are quite different. These two approaches to "privacy" are fundamentally divergent from each other. That being said, a freedom-loving nation must use government to exercise some forms of control. This tension between freedom and control is behind so many conflicts in the world, though I believe it is most pronounced with the issue of privacy, perhaps moreso than even with security.

The US government, serving a nation historically oriented toward the maximization of personal liberty, decided that providing strict, well-defined controls on certain types of information is better than not. As a result, three primary FEDERAL data control laws have been enacted: FERPA (educational data), HIPAA (health data), and COPPA (children's Internet data). In addition, some states have passed data control laws, such as California's CCPA. However, the US Constitution provides extremely robust "privacy protections" which do not explicitly refer to privacy, most directly so with the 3rd, 4th, and 5th Amendments, while the 1st, 9th, and 10th are more indirect.

The EU, on the other hand, appears to place control as a value of higher importance. As such, they passed the GDPR, though EU-US agreements like Safe Harbor and Privacy Shield attempted to accomplish similar goals in more modest terms. The GDPR is massively complex. I know at least one privacy scholar who believes that machine learning may no longer be viable in the EU because of the GDPR's data reuse provisions. If a data controller needs to get permission from the data producer every time that information is used as part of a machine learning process, ML research may become too burdensome.

Now, some European governments state that their citizens "have a right to privacy." This situation highlights the difference between a positive and negative right, which I argue is a meaningful distinction (though not all agree).

For example, the US Constitution generally provides rights to citizens in the negative form, such as, "Congress shall make no law...abridging the freedom of speech". A positive form of that same right is Article 35 of the PRC Constitution, which is: "Citizens of the People's Republic of China enjoy freedom of speech, of the press, of assembly, of association, of procession and of demonstration" [2]. In the former case, the nation ultimately defines what "freedom of speech" means; in the latter case, the government ultimately defines the meaning of "freedom of speech." Granted, not everyone agrees with this interpretation, but I believe history generally shows this to be true.

So, the question is, is a European, positive-right formulation of privacy better for the nation or the government? I argue the government. For these reasons, I cannot stress enough the importance of grasping the difference between the US and EU approaches to "privacy".

[1] https://iapp.org/about/what-is-privacy/

[2] https://constituteproject.org/constitution/China_2018