{"text_format":"2","workbook":"xlsx","n_sheets":2,"sheets":["Coversheet","Global Data Privacy Guide"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Coversheet","index":0,"n_rows":12,"n_cols":3,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[]
[null,"Prepared By:","Contributors:"]
[null,"Steptoe LLP"]
[]
[]
[]
["Global Data Privacy Guide"]
[]
["Report Generated: 5/1/2025"]
[]
["View your report results on next tab"]

{"sheet":"Global Data Privacy Guide","index":1,"n_rows":16,"n_cols":2,"rows_kept":16,"cut":false,"hidden":false,"merged":[]}
["Question","USA, District of Columbia (Federal Law)"]
["Key Legislation Overview"]
["What is the key legislation?"," Unlike many other countries, the United States does not have a single, overarching privacy law regulating the processing of personal information. Instead, there is an array of federal and state laws that regulate different aspects of privacy in the United States. \n\n Instead of a single, overarching privacy law regulating the processing of personal information, the United States has an array of federal and state laws that regulate different aspects of privacy in the United States. \n\n Federal Law \n\n For instance, the Gramm-Leach-Bliley Act (\" GLBA \") and regulations implementing it establish requirements for how financial institutions protect consumers’ personal information. Similarly, the Health Insurance Portability and Accountability Act of 1996 (\" HIPAA \") establishes privacy and data security requirements for entities in the health and medical sector. The Electronic Communications Privacy Act of 1986 (\" ECPA \")—composed of the Wiretap Act , the Stored Communications Act , and the Pen Register Act —establishes rules governing the privacy of electronic communications, including limits on disclosures by communications providers, prohibitions on access to communications content and non-content information, and restrictions on government access to stored communications and communications in transmission. \n\n Another key federal law is the Federal Trade Commission Act (\" FTCA \"), which prohibits “unfair” or “deceptive” acts or practices in commerce. The Federal Trade Commission (\" FTC \") has interpreted the “unfairness” prong of this Act as requiring companies to ensure reasonable security for the personal information of consumers. \n\n Other federal laws regulating privacy include (but are not limited to): \n\n \n\t The Cable Communications Policy Act of 1984 (\" Cable Act \"), which amended the Communications Act of 1934 , protects the personal information of customers of cable service providers; \n\t The Children’s Online Privacy Protection Act of 1998 (\" COPPA \"), which established rules for the collection, retention, and disclosure of personal information from children under 13 years of age online; \n\t The Communications Act of 1934 , which requires telecommunications carriers to protect the confidentiality of proprietary information of, and relating to, other telecommunications carriers, equipment manufacturers, and customers; \n\t The Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (\" CAN-SPAM \"), which regulates unsolicited commercial email and generally preempts state anti-spam laws; \n\t The Drivers Privacy Protection Act of 1994 (\" DPPA \"), which protects the privacy of personal information contained in motor vehicle records; \n\t The Fair Credit Reporting Act (\" FCRA \"), which was amended by the Fair and Accurate Credit Transactions Act of 2003 (\" FACTA \"), and limits the collection, use, maintenance, and dissemination of personal information assembled by Credit Reporting Agencies; \n\t The Family Education Rights and Privacy Act of 1974 (\" FERPA \"), which protects the privacy of student education records and applies to all schools that receive funds from the U.S. Department of Education; \n\t The Freedom of Information Act (\" FOIA \"), which provides for the disclosure of previously unreleased information and documents controlled by the federal government; \n\t The Privacy Act of 1974 , which established rules for the collection, maintenance, use, and dissemination of information about individuals maintained in systems of records by federal agencies; \n\t The Telephone Consumer Protection Act of 1991 (\" TCPA \"), which amended the Communications Act of 1934 and bars most auto-dialed or prerecorded calls, texts, and faxes unless made with prior express consent; and \n\t The Video Privacy Protection Act of 1988 (\" VPPA \"), which generally prevents the disclosure of personally identifiable rental records of “prerecorded video cassette tapes or similar audiovisual material.” \n \n\n State Law \n\n All of the states and U.S. territories also have laws affecting privacy. All 50 states and four territories (Washington, D.C., Puerto Rico, U.S. Virgin Islands, and Guam) have laws requiring businesses to notify affected individuals and (in some cases) regulators if they experience a breach of the security of personal information (with varying definitions of “personal information”). California was the first state to pass such a data breach reporting law.  See California Database Security Breach Notification Act, S.B. 1386 (Cal. 2002) , amending Cal. Civ. Code §§ 1798.29, 1798.82 & 1798.84 . \n\n An increasing number of states also impose general requirements to implement reasonable security measures to protect personal information. See, e.g., Massachusetts Security Breach Notification Law, Mass. Gen. Laws ch. 93H , and Standards for the Protection of Personal Information of Residents of the Commonwealth, 201 Mass. Code Regs. 17.00 et seq.; New York Stop Hacks and Improve Electronic Data Security Act, S.B. S5575B \n\n Many states also impose limits on the collection and processing of Social Security numbers. See, e.g., Virginia Personal Information Privacy Act, Va. Code Ann. § 59.1-443.2. \n\n States are also beginning to enact more overarching privacy laws affecting everything from the collection of personal information to the deletion of personal information and almost everything in between. The first such law was enacted by California as the California Consumer Privacy Act (\" CCPA \") which came into effect on January 1, 2020. The CCPA was recently amended by the California Privacy Rights Act (\" CPRA \"), which was enacted by voters via a ballot initiative. The CPRA will take effect on January 1, 2023, and will apply to data collected on or after January 1, 2022. Other states are expected to enact analogous legislation in 2021. In addition, Virginia and Colorado recently adopted similar laws. Virginia adopted the Virginia Consumer Data Privacy Act  (“ VCDPA ”), which will become effective on January 1, 2023, and Colorado adopted the Colorado Privacy Act (“ CPA ”), which will become effective on July 1, 2023. Numerous other states are considering similar legislation. \n"]
["Key Data Protection Provisions"]
["What data is protected?","Because the United States does not have a single, overarching privacy law, the definition of personal information depends on the applicable law or regulation.  Similarly, there is no universal concept of “sensitive data” that may be subject to heightened protections.\nBecause the United States does not have a single, overarching privacy law, the definition of personal information depends on the applicable law or regulation.  In the state security breach notification law context, for example, the definition of personal information generally includes an individual’s name, Social Security number, driver’s license number, and financial account number.  Notably, however, there is a trend toward broadening the definition of personal information in state breach notification laws to include health or medical information, online account information, and/or biometric information.  In other contexts, such as \nFTC enforcement actions, the \nGLBA, \nHIPAA, or the \nCCPA the definition of personal information is broader.  Certain laws apply only to electronic personal information, while others are more general.\nSimilarly, there is no universal concept of “sensitive data” that may be subject to heightened protections, though certain types of information are generally protected more stringently, such as financial data in the security breach notification context, as well as background screening information, consumer report information, health information, children’s information, and Social Security numbers. This approach, however, may be starting to change, as the \nCPRA, \nVCDPA, and \nCPA will all provide heightened protection for “sensitive” categories of personal information or data.\n"]
["Who is subject to privacy obligations?","Generally, U.S. privacy laws apply to all processing of personal information by organizations subject to the jurisdiction of U.S. courts. Many U.S. privacy laws are limited to businesses in certain sectors (for example, the \nGLBA applying only to covered financial institutions, \nHIPAA applying to covered health care institutions and their business associates, etc.). There are also privacy laws that apply to the U.S. government.\nUnlike in some other jurisdictions, U.S. law does not formally distinguish between “controllers” and “processors” of personal information, though certain laws impose different obligations on companies based on whether they own the data or are considered to be service providers. \nMany U.S. privacy laws are limited to businesses in certain sectors.  For example, the \nGLBA applies only to covered financial institutions.  \nHIPAA applies to covered health care institutions and their business associates. \nThere are also privacy laws, such as the \nPrivacy Act of 1974 and the \nECPA, that apply to the U.S. government.\nAt the state level, laws such as the\n CCPA, the \nVCDPA, and the \nCPA, currently or will employ thresholds relating to an entity’s revenue and/or the number of residents whose personal information an entity collects and/or sells.\n"]
["What are the principles applicable to personal data processing?","Companies that own personal information may be required to notify individuals whose data they collect. There are also restrictions on the collection of certain data, such as state laws restricting the collection of Social Security numbers.\nCompanies that own personal information may be required to notify individuals whose data they collect. Certain federal laws, such as the \nFCRA/FACTA, GLBA, HIPAA, and \nCOPPA (including regulations implementing these laws), require organizations to provide privacy notices in certain circumstances. \nCalifornia’s Online Privacy Protection Act also requires organizations not otherwise subject to specific regulation to post conspicuous privacy policies if they collect personal information from individuals through a website or online service for commercial purposes. The \nCCPA requires covered entities to provide consumers with notice of the categories of personal information to be collected and the purposes of collection both in their privacy policies and at or before the point of collection. The \nVCDPA and \nCPA will have similar notice requirements. The \nCPRA will require covered entities also to include information about the sale and retention of personal information at the point of collection. \nThere are also restrictions on the collection of certain data, such as state laws restricting the collection of Social Security numbers.\n"]
["How is the processing of personal data regulated?","U.S. privacy laws have not adopted the “finality principle” (i.e., that the use and disclosure of information be limited by the purpose for which it was originally collected); instead, companies usually describe their uses and disclosures of personal information collected from consumers in privacy notices.  It is important to ensure that the uses of personal information, and the circumstances in which and entities to which it may be disclosed, are described accurately.\nA number of laws also restrict the disclosure of specific types of personal information.\nU.S. privacy laws have not adopted the principle that the use and disclosure of personal information are limited by the purposes for which it was originally collected (subject to various exceptions)—known in other jurisdictions as the “finality principle.” Instead, companies usually describe their uses and disclosures of personal information collected from consumers in privacy notices.\nIf an organization would like to use previously collected personal information for a materially different purpose than those set forth in its privacy notice or to disclose it to entities or in circumstances different from what is stated in the privacy notice, the \nFTC and state attorneys general have said that the organization must first obtain consent to the new practice from the consumer. If an organization does not obtain such consent, then the new practice may be considered a deceptive trade practice under federal and state consumer protection laws. Where a privacy notice is required by law, an organization’s failure to abide by the requirements of the law could give rise to liability.\nA number of laws also restrict the disclosure of specific types of personal information. For example, the \nGLBA and \nHIPAA require an individual’s consent before making certain disclosures of personal information.\nAt the state level, the \nCCPA permits consumers to restrict the sale of their personal information. The \nCPRA will also provide consumers with the ability to opt out of the sharing of their personal information with third parties for the purpose of “cross-context behavioral advertising.” The \nVCDPA and \nCPA provide consumers with similar rights. The \nCPRA, \nVCDPA, and the \nCPA will also limit the ability of covered entities to use personal data beyond purposes disclosed to residents.\n"]
["How are storage, security and retention of personal data regulated?","Though there is no comprehensive U.S. data security law, a variety of federal and state statutes and regulations impose obligations on businesses to provide security.\nIn addition, U.S. privacy laws generally do not regulate the retention of personal information directly. However, the \nCCPA, allows California residents to request that businesses delete their personal information (subject to several important exceptions).\nThe \nFTC has taken the view that not providing “reasonable” security for consumers’ personal information is an “unfair practice” under the \nFTCA, and has brought dozens of enforcement actions against companies on that basis. Companies must consult complaints and consent decrees from past cases to try to understand what constitutes reasonable or unreasonable security in the mind of the \nFTC.\nA variety of other federal statutes and regulations impose more specific security obligations on certain data owners and organizations that process personal information on their behalf. For example, the Safeguards Rule implemented pursuant to the \nGLBA requires financial institutions to “develop, implement, and maintain a comprehensive information security program” with “administrative, technical, and physical safeguards” to protect the security, confidentiality, and integrity of all nonpublic personal information. \nCOPPA requires operators of commercial websites and online services to maintain the confidentiality, security, and integrity of “personal information” (as defined by the \nFTC’s implementing regulation) they collect from children.  The Security Rule implemented pursuant to \nHIPAA prescribes detailed administrative, technical, and physical safeguards for covered entities and their service providers to protect the security, confidentiality, availability, and integrity of electronically protected health information.\nA number of state laws also impose general information security standards on companies that maintain personal information. California has enacted legislation requiring businesses to “implement and maintain reasonable security procedures and practices” to protect personal information about California residents from unauthorized access, destruction, use, modification, or disclosure. \nCal. Civ. Code § 1798.81.5(b). Massachusetts also requires businesses to develop and maintain a comprehensive written information security program, including specific elements.  See \nStandards for the Protection of Personal Information of Residents of the Commonwealth, 201 Mass. Code Regs. 17.00 et seq. Other states are also increasingly adopting specific data security requirements for personal information.\nIn addition, U.S. privacy laws generally do not regulate the retention of personal information directly, though there are many records retention laws at the federal and state levels that require companies to retain records (including those that contain personal information) for a specified length of time or restrict the retention of records beyond a certain period. However, at the state level, the \nCPRA  will place limits on a covered entity’s ability to retain personal information. In addition, the \nCCPA allows California residents to request that businesses delete their personal information (subject to several important exceptions) and the \nVCDPA and the \nCPA will afford consumers this right in 2023.\n"]
["What are the data subjects' rights?","There is no generally applicable law in the United States providing individuals the right to access or correct personal information about them held by a company, though there are specific laws that address access and correction rights, such as the \nPrivacy Act of 1974, \nHIPAA, \nCOPPA, and \nFCRA/FACTA. In addition, the \nCCPA provides residents with the right to ask businesses to access personal information as will the \nVCDPA and the \nCPA. The \nCPRA, the \nVCDPA, and the \nCPA will also provide consumers with the right to correct inaccurate personal information. \nThere is no generally applicable law in the United States providing individuals the right to access or correct personal information about them held by a company, though there are specific laws that address access and correction rights. For example, the \nPrivacy Act of 1974 requires federal agencies to provide individuals, upon request, with access to information about them, subject to certain exceptions, and allow individuals to request amendments to their records.\nThe \nPrivacy Rule enacted pursuant to \nHIPAA requires covered entities to provide individuals, upon request, with access to the protected health information (\nPHI) about them, unless the covered entity has a valid reason to deny such access (e.g., where the \nPHI is subject to restricted access under other laws, or access to the \nPHI is reasonably likely to cause substantial harm to another person). A covered entity must either provide the requested access within thirty days of a request or explain its justification for denying access. The \nPrivacy Rule also gives individuals the right to amend their \nPHI. \nCOPPA allows parents or legal guardians to access their child’s personal information upon request, and revoke their consent and refuse the further use or collection of personal information from their child, or delete their child’s personal information.\nFCRA/\nFACTA requires Credit Reporting Agencies to provide individuals with information in their credit files upon request. Individuals may also dispute inaccurate information that appears in a credit report, and inaccurate or unverifiable information must be removed within thirty days of notice of the dispute.\n"]
["Are there restrictions on cross-border data transfers?","No, U.S. law does not restrict cross-border data transfers.\n"]
["Are there any notification requirements for data breaches?","There is no generally applicable federal breach notification law, but there are a number of targeted breach notification laws at both the federal and state levels, including:\nHIPAA and the HITECH ActThe \nHIPAA Breach Notification Rule requires \nHIPAA-covered entities and their business associates to provide notification following a breach of unsecured protected health information. Similar breach notification provisions implemented and enforced by the \nFTC apply to vendors of personal health records and third-party service providers pursuant to the \nHealth Information Technology for Economic and Clinical Health Act (\"\nHITECH Act\").\nGLBA and Federal Interagency GuidanceSeveral federal banking regulators—the Office of the Comptroller of the Currency, Federal Reserve Board, Federal Deposit Insurance Corporation, and Office of Thrift Supervision—issued \nInteragency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice in 2005, interpreting the \nSafeguards Rule implemented pursuant to the \nGLBA to require financial institutions to develop and implement a response program designed to address incidents of unauthorized access to customer information processed in systems the institutions or their service providers use to access, collect, store, use, transmit, protect, or dispose of the information. The \nGuidance also contains breach notification requirements.\nState Breach Notification LawsAll 50 states and four territories (Washington, D.C., Puerto Rico, U.S. Virgin Islands, and Guam) have enacted breach notification laws requiring data owners to notify affected individuals and (in some cases) regulators in the event of unauthorized access to or acquisition of their personal information. Although some state breach laws require notification only if there is a reasonable likelihood that the breach will result in harm to affected individuals, other jurisdictions require notification of any incident that meets their definition of a breach.\n"]
["Who is the privacy regulator?","There is no single authority in the United States that regulates privacy law. At the federal level, the regulatory authority responsible for oversight varies based on the applicable law or regulation. The \nFTC is the primary federal privacy regulator and may bring privacy enforcement actions pursuant to section 5 of the \nFTCA to address a wide range of alleged violations by entities whose information practices have been deemed “deceptive” or “unfair.” These enforcement actions typically result in consent decrees that prohibit companies from future misconduct and often require biennial audits for up to twenty years. The \nFTC may also impose a fine on businesses that violate a consent decree.\nIn the financial services context, various financial services and state insurance regulators have adopted standards pursuant to the \nGLBA regulating the collection, use, and disclosure of non-public personal information.  In the healthcare context, the Department of Health and Human Services is responsible for the enforcement of \nHIPAA against covered entities.\nAt the state level, attorneys general may bring enforcement actions for unfair or deceptive trade practices and enforce violations of specific state privacy laws. In California, in particular, the \nCPRA created a new privacy regulator called the California Privacy Protection Board to enforce the statute and the \nCCPA. The \nVCDPA will be exclusively enforced by the Virginia Attorney General while the \nCPA will be exclusively enforced by the Colorado Attorney General and Colorado district attorneys. Some state privacy laws also allow individuals to sue for damages when violations occur.\n"]
["What are the consequences of a privacy breach?","Violations of federal and state privacy laws generally can lead to injunctions and civil penalties, though several laws directed at surveillance activities and computer crimes also impose criminal sanctions. Violations of the \nECPA or the \nComputer Fraud and Abuse Act (\"\nCFAA\") can lead to both civil liability and criminal sanctions. Many states have also enacted surveillance laws that provide for both civil liability and criminal sanctions in the case of a violation. Outside of the surveillance and computer crime context, the U.S. Department of Justice has the authority to criminally prosecute serious \nHIPAA violations.\nPrivacy breaches have also led to civil lawsuits against breached companies by individuals or other entities affected by the breach, with varying degrees of success. The \nCCPA expressly provides California residents a private right of action for data breaches.\n"]
["How is electronic marketing regulated?","Several U.S. laws target electronic marketing, including commercial email, telemarketing, text message marketing, and fax marketing.\nCommercial email is regulated at the federal level by \nCAN-SPAM, which generally preempts state anti-spam laws.\nThe \nTCPA and the \nTelemarketing and Consumer Fraud and Abuse Prevention Act, as well as regulations implemented by the \nFTC and the Federal Communications Commission (\n\"FCC\"), regulate telemarketing. There are also state laws regulating telemarketing activities.\nText message marketing is regulated primarily by the \nTCPA and regulations implemented by the \nFCC, while fax marketing is regulated by the \nTCPA, as amended by the \nJunk Fax Prevention Act of 2005, and state laws.\nIn 2021, the U.S. Supreme Court significantly narrowed the scope of a portion of the \nTCPA restricting the use of auto-dialer equipment to place calls and text messages. In the aftermath of the Supreme Court’s decision, Florida adopted a mini-\nTCPA law and other states are considering taking similar action.\n"]
["Are there any recent developments or expected reforms?","The \nCalifornia Consumer Privacy Act (\"\nCCPA\"), which took effect on January 1, 2020, establishes new rights on the part of California residents to control their personal information by requesting that companies disclose what personal information they collect, and for what purpose, and what types of entities they share the information with. The \nCCPA also gives California residents the right to request that companies delete their personal information (subject to important exceptions), and also that companies do not sell their personal information. \nNote: As noted above, the \nCCPA took effect on January 1, 2020. In addition to the rights described above, which are currently enforceable by the state attorney general, the \nCCPA also creates a private right of action that allows California residents to sue businesses, and obtain statutory damages, when a lack of adequate security leads to a breach of certain types of personal information. In November 2020, California voters passed the \nCPRA as part of a ballot initiative that amends the \nCCPA as described above. The substantive rights created by the \nCRPA will not become effective until January 1, 2023, and will only apply to information collected on or after January 1, 2022. In addition, as noted above, the \nCPRA creates a new California Privacy Protection Board which will be responsible for enforcing the \nCCPA and rulemaking.\nThe \nCCPA and \nCPRA have led other states to adopt similar legislation. —As mentioned, Virginia recently adopted the \nVCDPA and Colorado recently adopted the \nCPA, which are substantively similar to the \nCCPA and \nCPRA. The \nVCDPA will come into effect on January 1, 2023, and the \nCPA will come into effect on July 1, 2023. Similar legislation is being considered in a number of additional states.\n"]