Unlike the EU, Australia and Canada, the U.S. does not have comprehensive federal data privacy laws. Instead, the U.S. addresses data privacy through piecemeal federal and state-level measures — and some of these laws also address data security. The following are a few commonly cited federal legislative and regulatory measures that address data privacy, data security, or both:

Gramm-Leach-Bliley Act: Requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data.
FTC Safeguards Rules: Requires covered financial institutions to develop, implement, and maintain an information security program with administrative, technical, and physical safeguards designed to protect customer information.
Fair Credit Reporting Act: Governs access to consumer credit report records and promotes accuracy, fairness, and the privacy of personal information assembled by credit reporting agencies.
Health Insurance Portability and Accountability Act: Protects sensitive patient health information from being disclosed without the patient's consent or knowledge.

Beyond federal measures, many states have enacted laws regarding the protection and/or use of personal information, including:

California Privacy Rights Act: Expands existing laws and, among other things, creates a new category of sensitive personal information and the right to limit the use of that information, and it imposes stricter obligations on certain businesses that handle personal data, including the need to conduct regular risk assessments and data protection assessments.
New York SHIELD Act: Strengthens existing data security laws by expanding the types of personal data that requires consumer notice after a breach and requires that companies protect the security, confidentiality, and integrity of personal data.
Oregon Consumer Protection Act: Provides individuals with numerous rights over their personal data and imposes obligations on businesses and how they utilize consumers' personal data.
Massachusetts Information Privacy and Security Act: Requires anyone who utilizes the personal data of a Massachusetts resident to develop, implement, and maintain a comprehensive information security program.

How businesses can prioritize data privacy

With so many changes and new regulations, it's clear that businesses should continue to prioritize data privacy going forward. But what does it actually mean to protect data? And how can businesses prioritize data privacy?

Special Reports /

Preserving data privacy in a digital age

Related Stories

Recommended For You