Which of these laws was created in order to directly protect consumers?

1. Relevant Legislation and Competent Authorities

1.1        What is the principal data protection legislation?

There is no single principal data protection legislation in the United States (U.S.).  Rather, a jumble of hundreds of laws enacted on both the federal and state levels serve to protect the personal data of U.S. residents.  At the federal level, the Federal Trade Commission Act (15 U.S. Code § 41 et seq.) broadly empowers the U.S. Federal Trade Commission (FTC) to bring enforcement actions to protect consumers against unfair or deceptive practices and to enforce federal privacy and data protection regulations.  The FTC has taken the position that “deceptive practices” include a company’s failure to comply with its published privacy promises and its failure to provide adequate security of personal information, in addition to its use of deceptive advertising or marketing methods.

As described more fully below, other federal statutes primarily address specific sectors, such as financial services or healthcare.  In parallel to the federal regime, state-level statutes protect a wide range of privacy rights of individual residents.  The protections afforded by state statutes often differ considerably from one state to another, and some are comprehensive, while others cover areas as diverse as protecting library records to keeping homeowners free from drone surveillance.

1.2        Is there any other general legislation that impacts data protection?

Although there is no general federal legislation impacting data protection, there are a number of federal data protection laws that are sector-specific (see question 1.3 below), or focus on particular types of data.  By way of example, the Driver’s Privacy Protection Act of 1994 (DPPA) (18 U.S. Code § 2721 et seq.) governs the privacy and disclosure of personal information gathered by state Departments of Motor Vehicles.  Children’s information is protected at the federal level under the Children’s Online Privacy Protection Act (COPPA) (15 U.S. Code § 6501), which prohibits the collection of any information from a child under the age of 13 online and from digitally connected devices, and requires publication of privacy notices and collection of verifiable parental consent when information from children is being collected.  The Video Privacy Protection Act (VPPA) (18 U.S. Code § 2710 et seq.) restricts the disclosure of rental or sale records of videos or similar audio-visual materials, including online streaming.  Similarly, the Cable Communications Policy Act of 1984 includes provisions dedicated to the protection of subscriber privacy (47 U.S. Code § 551).

State laws also may impose restrictions and obligations on businesses relating to the collection, use, disclosure, security, or retention of special categories of information, such as biometric data, medical records, SSNs, driver’s licence information, email addresses, library records, television viewing habits, financial records, tax records, insurance information, criminal justice information, phone records, and education records, just to name some of the most common.

Every state has adopted data breach notification legislation that applies to certain types of personal information about its residents.  Even if a business does not have a physical presence in a particular state, it typically must comply with the state’s laws when faced with the unauthorised access to, or acquisition of, personal information it collects, holds, transfers or processes about that state’s residents.  The types of information subject to these laws vary, with most states defining personal information to include an individual’s first name or first initial and last name, together with a data point including the individual’s SSN, driver’s licence or state identification card number, financial account number or payment card information. 

Some states are more active than others when it comes to data protection.  Massachusetts, for example, has strong data protection regulations (201 CMR 17.00), requiring any entity that receives, stores, maintains, processes, or otherwise has access to “personal information” of a Massachusetts resident in connection with the provision of goods or services, or in connection with employment, (a) to implement and maintain a comprehensive written information security plan (WISP) addressing 10 core standards, and (b) to establish and maintain a formal information security programme that satisfies eight core requirements, which range from encryption to information security training. 

In 2019, New York expanded its data breach notification law to include the express requirement that entities develop, implement and maintain “reasonable” safeguards to protect the security, confidentiality and integrity of private information.  Significantly, New York’s SHIELD Act (N.Y. Gen Bus. Law§ 899-bb) identifies a series of administrative, technical, and physical safeguards which, if implemented, are deemed to satisfy New York’s reasonableness standard under the law.  Previously, New York prioritised the regulation of certain financial institutions doing business in the state, by setting minimum cybersecurity standards, with requirements for companies to perform periodic risk assessments and file annual compliance certifications (23 NYCRR 500).

Illinois has a uniquely expansive state law (740 ILCS 14/), which imposes requirements on businesses that collect or otherwise obtain biometric information.  The Illinois Biometric Information Privacy Act (BIPA) is notable as, at the time of writing, the only state law regulating biometric data usage that allows private individuals to sue and recover damages for violations.  In January 2019, the Illinois Supreme Court offered an expansive reading of the protections of the BIPA, holding that the law does not require individuals to show they suffered harm other than a violation of their legal rights to sue.

California has a long history of adopting privacy-forward legislation, and in 2018, the state enacted the California Consumer Privacy Act (“CCPA”), which became effective on January 1, 2020.  The law introduced new obligations on covered businesses, including requirements to disclose the categories of personal information the business collects about consumers, the specific pieces of personal information the business collected about the consumer, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting or selling personal information, and the categories of third parties with which the business shares personal information.  It also introduced new rights for California residents, including the right to request access to and deletion of personal information and the right to opt out of having personal information sold to third parties.

More recently, we have seen a number of states push towards enacting comprehensive consumer data privacy laws.  Specifically, in 2020, California amended the CCPA with the California Privacy Rights Act (CPRA), which expanded the rights granted to consumers and increased compliance obligations on businesses.  In 2021, Virginia enacted the Consumer Data Protection Act (CDPA) becoming the second state with a comprehensive data privacy law, followed shortly thereafter by Colorado, which enacted the Colorado Privacy Act (CPA).  Continuing this trend, in March 2022, Utah enacted the Utah Consumer Privacy Act (UCPA), and in May 2022, Connecticut enacted an Act Concerning Personal Data Privacy and Online Monitoring (Connecticut Privacy Act), bringing the number of US states with comprehensive data privacy legislation up to five. These recently passed state date privacy laws are not yet effective. California and Virginia will come into effect on January 1, 2023, followed by the Colorado and Connecticut on July 1, 2023 and Utah on December 31, 2023.  In the absence of a data privacy framework at the federal level, states continue to pursue legislation. At the time of writing, the authors are aware of 13 comprehensive privacy bills before the legislatures of eight different states.

1.3        Is there any sector-specific legislation that impacts data protection?

Key sector-specific laws include those covering financial services, healthcare, telecommunications, and education.

The Gramm Leach Bliley Act (GLBA) (15 U.S. Code § 6802(a) et seq.) governs the protection of personal information in the hands of banks, insurance companies and other companies in the financial service industry.  This statute addresses “Non-Public Personal Information” (NPI), which includes any information that a financial service company collects from its customers in connection with the provision of its services.  It imposes requirements on financial service industry companies for securing NPI, restricting disclosure and use of NPI and notifying customers when NPI is improperly exposed to unauthorised persons.

The Fair Credit Reporting Act (FCRA), as amended by the Fair and Accurate Credit Transactions Act (FACTA) (15 U.S. Code § 1681), restricts use of information with a bearing on an individual’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living to determine eligibility for credit, employment or insurance.  It also requires the truncation of credit card numbers on printed receipts, requires the secure destruction of certain types of personal information, and regulates the use of certain types of information received from affiliated companies for marketing purposes.

In addition to financial industry laws and regulation, the major credit card companies require businesses that process, store or transmit payment card data to comply with the Payment Card Industry Data Security Standard (PCI-DSS).

The Health Information Portability and Accountability Act, as amended (HIPAA) (29 U.S. Code § 1181 et seq.) protects information held by a covered entity that concerns health status, provision of healthcare or payment for healthcare that can be linked to an individual.  Its Privacy Rule regulates the collection and disclosure of such information.  Its Security Rule imposes requirements for securing this data.

The Telephone Consumer Protection Act (TCPA) (47 U.S. Code § 227) and associated regulations regulate calls and text messages to mobile phones, and regulate calls to residential phones that are made for marketing purposes or using automated dialling systems or pre-recorded messages.

The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g) provides students with the right to inspect and revise their student records for accuracy, while also prohibiting the disclosure of these records or other personal information on the student, without the student’s or parent’s (in some instances) consent.

Where a federal statute covers a specific topic, the federal law may pre-empt any similar state law on that topic.  However, certain federal laws, like the GLBA for instance, specify that they are not pre-emptive of state laws on the subject.

1.4        What authority(ies) are responsible for data protection?

While the United States has no plenary data protection regulator, the FTC’s authority is very broad, and often sets the tone on federal privacy and data security issues.  In addition, a variety of other agencies regulate data protection through sectoral laws, including the Office of the Comptroller of the Currency (OCC), the Department of Health and Human Services (HHS), the Federal Communications Commission (FCC), the Securities and Exchange Commission, the Consumer Financial Protection Bureau (CFPB) and the Department of Commerce. At the state level, the California Privacy Rights Act established the first dedicated privacy regulator in the United States, the California Privacy Protection Agency (CPPA). The CPPA’s responsibilities will include enforcement of the CPRA with the California Attorney General, rulemaking under the CPRA, and promoting public awareness of privacy issues.

2. Definitions

2.1        Please provide the key definitions used in the relevant legislation:

“Personal Data”

In the United States, information relating to an individual is typically referred to as “personal information” (rather than personal data), though notably, recent privacy legislation in Virginia, Colorado, Utah, and Connecticut use the term “personal data.” The definition of personal information in the U.S. is not uniform across all states or all regulations.  In addition, certain data may be considered personal information for one purpose but not for another.

“Processing”

This is not yet applicable in our jurisdiction. Upcoming laws in Virginia, Colorado, Utah, and Connecticut will incorporate this term; however, these will not be applicable until 2023.

“Controller”

This is not yet applicable in our jurisdiction. Upcoming laws in Virginia, Colorado,  Utah, and Connecticut will incorporate this term; however, these will not be applicable until 2023.

“Processor”

This is not yet applicable in our jurisdiction. Upcoming laws in Virginia, Colorado, Utah, and Connecticut will incorporate this term; however, these will not be applicable until 2023.

“Data Subject”

The state data protection statutes typically cover a “consumer” residing within the state.  The definition of “consumer” differs by state.  Under many state data protection statutes, a “consumer” is an individual who engages with a business for personal, family or household purposes.  In contrast, under the California Consumer Privacy Act (CCPA) a “consumer” is defined broadly as a “natural person who is a California resident”. Legislation in Virginia, Colorado, Utah, and Connecticut have taken a similar approach to their respective definitions of “consumer”.

“Sensitive Personal Data”

This is not yet applicable in our jurisdiction. Upcoming laws in Virginia, Colorado,  Utah, and Connecticut will incorporate this term; however, these will not be applicable until 2023.

“Data Breach”

The definition of a Data Breach depends on the individual state statute, but typically involves the unauthorised access or acquisition of computerised data that compromises the security, confidentiality, or integrity of personal information.

Other key definitions

This is not applicable in our jurisdiction.

3. Territorial Scope

3.1        Do the data protection laws apply to businesses established in other jurisdictions? If so, in what circumstances would a business established in another jurisdiction be subject to those laws?

Businesses established in other jurisdictions may be subject to both federal and state data protection laws for activities impacting United States residents whose information the business collects, holds, transmits, processes or shares.

4. Key Principles

4.1        What are the key principles that apply to the processing of personal data?

Transparency

The FTC has issued guidelines espousing the principle of transparency, recommending that businesses: (i) provide clearer, shorter, and more standardised privacy notices that enable consumers to better comprehend privacy practices; (ii) provide reasonable access to the consumer data they maintain that is proportionate to the sensitivity of the data and the nature of its use; and (iii) expand efforts to educate consumers about commercial data privacy practices.

Lawful basis for processing

While there is no “lawful basis for processing” requirement under U.S. law, the FTC recommends that businesses provide notice to consumers of their data collection, use and sharing practices and obtain consent in limited circumstances where the use of consumer data is materially different than claimed when the data was collected, or where sensitive data is collected for certain purposes.

Purpose limitation

The FTC recommends privacy-by-design practices that include limiting “data collection to that which is consistent with the context of a particular transaction or the consumer’s relationship with the business, or as required or specifically authorized by law”.

Data minimisation

See above.

Proportionality

See above.

Retention

The FTC recommends privacy-by-design practices that implement “reasonable restrictions on the retention of data”, including disposal “once the data has outlived the legitimate purpose for which it was collected”.

Other key principles

This is not applicable in our jurisdiction.

5. Individual Rights

5.1        What are the key rights that individuals have in relation to the processing of their personal data?

Right of access to data/copies of data

 These rights are statute-specific.  For example, under certain circumstances, employees are entitled to receive copies of data held by employers.  In other circumstances, parents are entitled to receive copies of information collected online from their children under the age of 13.  Under HIPAA, individuals are entitled to request copies of medical information held by a health services provider.  At the state level, the CCPA provides a right of access for California residents to personal information held by a business relating to that resident. The CPRA, Virginia CDPA, the Colorado Privacy Act  the Utah Consumer Privacy Act, and the Connecticut Privacy Act will provide a similar right.

Right to rectification of errors

These rights are statute-specific.  Some laws, such as the FCRA, provide consumers with a right to review data about the consumer held by an entity and request corrections to errors in that data.  At the state level, the right to correct information commonly attaches to credit reports, as well as criminal justice information, employment records, and medical records. Upcoming state data privacy legislation, including the CPRA, the Virginia CDPA, the Colorado Privacy Act, and the Connecticut Privacy Act provide a consumer right to correct inaccuracies in personal data held by a business.

Right to deletion/right to be forgotten

These rights are statute-specific.  By way of federal law example, COPPA provides parents the right to review and delete their children’s information and may require that data be deleted even in the absence of a request.  Some state laws, such as the CCPA, provide a right of deletion for residents of the respective states, with certain exceptions.  The CPRA, Virginia CDPA, the Colorado Privacy Act, the Utah Consumer Privacy Act, and the Connecticut Privacy Act will provide a similar right to delete.

Right to object to processing

These rights are statute-specific.  Individuals are given the right to opt out of receiving commercial (advertising) emails under CAN-SPAM and the right to not receive certain types of calls to residential or mobile telephone numbers without express consent under the TCPA.  Some states provide individuals with the right not to have telephone calls recorded without either consent of all parties to the call or consent of one party to the call.

Right to restrict processing

These rights are statute-specific.  Certain laws restrict how an entity may process consumer data.  For example, the CCPA allows California residents, and the Nevada Privacy Law allows Nevada residents to prohibit a business from selling that individual’s personal information.  The newly enacted Virginia CDPA, Colorado Privacy Act, and Connecticut Privacy Act will provide a right to restrict processing for the purposes of sale, targeted advertising, and profiling. The Utah Consumer Privacy Act will provide a slightly narrower right to restrict processing for the purposes of sale or targeted advertising.

Right to data portability

These rights are statute-specific.  Examples of consumer rights to data portability exist under HIPAA, where individuals are entitled to request that medical information held by a health services provider be transferred to another health services provider.  In addition, the CCPA currently provides a right of data portability for their respective state residents. The CPRA, Virginia CDPA, the Colorado Privacy Act the Utah Consumer Privacy Act, and the Connecticut Privacy Act will provide a similar right to data portability.

Right to withdraw consent

These rights are statute-specific.  By way of example, under the TCPA, individuals are permitted to withdraw consent given to receive certain types of calls or texts to residential or mobile telephone lines.

Right to object to marketing

These rights are statute-specific.  Several laws permit consumers to restrict marketing activities involving their personal data.  Under CAN-SPAM, for example, individuals may opt out of receiving commercial (advertising) emails.  Under the TCPA, individuals must provide express written consent to receive marketing calls/texts to mobile telephone lines.  California’s Shine the Light Act requires companies that share personal information for the recipient’s direct marketing purposes to either provide an opt-out or make certain disclosures to the consumer of what information is shared, and with whom. The CPRA, Virginia CDPA, the Colorado Privacy Act, the Utah Consumer Privacy Act, and the Connecticut Privacy Act will provide consumers with the right to opt out of processing of their personal information for targeted advertising.

Right protecting against solely automated decision-making and profiling

This is not applicable to our jurisdiction. Upcoming laws and regulations in California, Virginia, Colorado, and Connecticut will incorporate this right; however, these will not be applicable until 2023.

Right to complain to the relevant data protection authority(ies)

These rights are statute-specific.  By way of example, individuals may report unwanted or deceptive commercial email (“spam”) directly to the FTC, and telemarketing violations directly to the FCC.  Similarly, anyone may file a HIPAA complaint directly with the Department of Health and Human Services (HHS).  At the state level, California residents may report alleged violations of the CCPA to the California Attorney General. Under the CPRA, California residents will be able to report alleged violations to the CPPA.  Similarly, under the UCPA, Utah residents will be able to report alleged violations to the state’s Consumer Protection Division.

Other key rights

This is not applicable in our jurisdiction.

6. Children’s Personal Data

6.1        What additional obligations apply to the processing of children’s personal data?

Children’s information is protected at the federal level under the Children’s Online Privacy Protection Act (COPPA) (15 U.S. Code § 6501).  COPPA requires operators of: (a) commercial websites and online services directed to children under the age of 13; or (b) general or mixed audience commercial websites or online services with actual knowledge they are collecting personal information from children under the age of 13 to meet specific compliance obligations where they collect personal information from children under the age of 13.  Specifically, COPPA requires that covered operators: (1) publish certain privacy notices, including a COPPA compliant privacy policy and “direct notice” to parents prior to the collection of personal information from their child; (2) obtain parental consent prior to collecting personal information from a child under the age of 13; (3) provide parents a choice regarding disclosure of a child’s information to third parties under certain circumstances; (4) provide parents access to their child’s personal information and opportunities to delete that information or prevent further use or collection of a child’s information; and (5) maintain the confidentiality, security, and integrity of the information collected.  At the time of writing, additional federal legislation that would increase protections for children’s privacy online has been introduced and is currently pending.

At the state level, the CCPA alters its right to opt out of sale of personal information for consumers under the age of 16. Rather than opt out, businesses are prohibited from selling personal information of consumers under the age of 16, without affirmative authorisation from a consumer aged 13–15 or from the parent or legal guardian of a consumer under the age of 13.  The CPRA will expand this right to include affirmative authorisation to share personal information.  Further, the CPRA will also increase administrative fines to $7,500 for any violation involving personal information of minors under the age of 16.  The upcoming privacy laws in Virginia, Colorado, Utah, and Connecticut include personal data of a child younger than the age of 13 as sensitive personal data.  In Virginia, Utah, and Connecticut, controllers must process a child’s data in accordance with COPPA.  The Colorado Privacy Act requires consumer consent before processing sensitive personal data; however, it exempts personal data subject to COPPA.

7. Registration Formalities and Prior Approval

7.1        Is there a legal obligation on businesses to register with or notify the data protection authority (or any other governmental body) in respect of its processing activities?

Both Vermont and California require data brokers to register with the state attorney general.  The Vermont requirement, which went into effect in 2019, defines a “data broker” to include entities that knowingly collect and sell or license to third parties the personal information of a consumer with whom the business does not have a direct relationship (9 V.S.A. chapter 62).  California’s requirement went into effect in 2020, and similarly applies to the knowing collection and sale of personal information regarding consumers with which the business does not have a direct relationship (Cal. Civ. Code § 1798.99.82).

7.2        If such registration/notification is needed, must it be specific (e.g., listing all processing activities, categories of data, etc.) or can it be general (e.g., providing a broad description of the relevant processing activities)?

The states that have mandated data broker registration generally do not require a specific description of relevant data processing activities.  California makes it optional for the data broker to provide within its registration any information concerning its data collection practices (Cal. Civ. Code § 1798.99.82).  Vermont, in contrast, is more demanding and requires registrants to disclose information regarding consumer opt-out, whether the data broker implements a purchaser credentialling process, and the number and extent of any data broker security breaches it experienced during the prior year.  Where data brokers knowingly possess information about minors, Vermont law requires that they detail all related data collection practices, databases, sales activities, and opt-out policies (9 V.S.A. § 2446).

7.3        On what basis are registrations/notifications made (e.g., per legal entity, per processing purpose, per data category, per system or database)?

Data broker registrations are made on a “per legal entity” basis.

7.4        Who must register with/notify the data protection authority (e.g., local legal entities, foreign legal entities subject to the relevant data protection legislation, representative or branch offices of foreign legal entities subject to the relevant data protection legislation)?

Within the states for which it applies, registrations are required based on the business falling within the definition of a “data broker” pursuant to state law.  Generally, a “data broker” is defined as a business that knowingly collects and sells the personal information of a consumer with whom the business does not have a direct relationship.

7.5        What information must be included in the registration/notification (e.g., details of the notifying entity, affected categories of individuals, affected categories of personal data, processing purposes)?

See question 6.2 above.

7.6        What are the sanctions for failure to register/notify where required?

In Vermont, the penalty is US$50 per day in addition to the registration fee of US$100.  In California, a data broker that fails to register is liable for civil penalties, fees, and costs of US$100 for each day the data broker fails to register and an amount equal to the fees that were due during the period it failed to register.

7.7        What is the fee per registration/notification (if applicable)?

Fees vary by state.  The data broker registration fee in Vermont is US$100 and in California it is US$400.

7.8        How frequently must registrations/notifications be renewed (if applicable)?

In both Vermont and California, data brokers are required to register annually.

7.9        Is any prior approval required from the data protection regulator?

Data broker registration submissions require Attorney General approval in both Vermont and California.

7.10      Can the registration/notification be completed online?

Data broker registration for both Vermont and California may be completed online.

7.11      Is there a publicly available list of completed registrations/notifications?

Vermont and California maintain publicly available lists of registered data brokers.

7.12      How long does a typical registration/notification process take?

Neither Vermont nor California publish information concerning the typical amount of time for the data broker registration process.

8. Appointment of a Data Protection Officer

8.1        Is the appointment of a Data Protection Officer mandatory or optional? If the appointment of a Data Protection Officer is only mandatory in some circumstances, please identify those circumstances.

Appointment of a Data Protection Officer is not required under U.S. law, but certain statutes require the appointment or designation of an individual or individuals who are charged with compliance with the privacy and data security requirements under the statute.  These include the GLBA, HIPAA, and the Massachusetts Data Security Regulation, for example.

8.2        What are the sanctions for failing to appoint a Data Protection Officer where required?

Potential sanctions are statute/regulator-specific.

8.3        Is the Data Protection Officer protected from disciplinary measures, or other employment consequences, in respect of his or her role as a Data Protection Officer?

This is not applicable in our jurisdiction.

8.4        Can a business appoint a single Data Protection Officer to cover multiple entities?

This is not applicable in our jurisdiction.

8.5        Please describe any specific qualifications for the Data Protection Officer required by law.

This is not applicable in our jurisdiction.

8.6        What are the responsibilities of the Data Protection Officer as required by law or best practice?

This is not applicable in our jurisdiction.

8.7        Must the appointment of a Data Protection Officer be registered/notified to the relevant data protection authority(ies)?

This is not applicable in our jurisdiction.

8.8        Must the Data Protection Officer be named in a public-facing privacy notice or equivalent document?

This is not applicable in our jurisdiction.

9. Appointment of Processors

9.1        If a business appoints a processor to process personal data on its behalf, must the business enter into any form of agreement with that processor?

Under certain state laws and federal regulatory guidance, if a business shares certain categories of personal information with a vendor, the business is required to contractually bind the vendor to reasonable security practices.  HIPAA, for example, requires the use of Business Associate Agreements for the transfer of protected health information to vendors.  The CCPA requires written contracts with service providers. The CPRA will extend the written contract requirement to contractors. Similarly, the Virginia CDPA, Colorado Privacy Act, the Utah Consumer Privacy Act, and the Connecticut Privacy Act will require controllers to enter into contracts with processors.

9.2        If it is necessary to enter into an agreement, what are the formalities of that agreement (e.g., in writing, signed, etc.) and what issues must it address (e.g., only processing personal data in accordance with relevant instructions, keeping personal data secure, etc.)?

The form of the contract typically is not specified.  HIPAA, however, is an example of a statute with minimum requirements for provisions that must be included within Business Associate Agreements.  These agreements must include limitations on use and disclosure, and require vendors to abide by HIPAA’s Security Rule, to provide breach notification and report on unauthorised use and disclosure, to return or destroy protected data, and to make its books, records, and practices available to the federal regulator. Requirements under state data privacy legislation vary by jurisdiction. Under the CCPA, the contract must restrict the service provider from retaining, using, or disclosing personal information for any purpose other than performance of the services specified in the contract. The CPRA will impose additional contract provisions on both service providers and contractors, including requiring that contracts prohibit service providers from selling or sharing personal information and from retaining, using, or disclosing personal information outside of the direct business relationship between the business and the service provider. Additionally, the Virginia CDPA, Colorado Privacy Act, the Utah Consumer Privacy Act, and the Connecticut Privacy Act will each require that a contract set forth instructions for processing, including the type of data subject to processing and the nature and purpose of processing and set specific requirements regarding engagement of subcontractors.  The Colorado Privacy Act will further require that controller and processor implement appropriate technical and organizational measures to ensure appropriate security.

10. Marketing

10.1      Please describe any legislative restrictions on the sending of electronic direct marketing (e.g., for marketing by email or SMS, is there a requirement to obtain prior opt-in consent of the recipient?).

Prior express written consent is required under the TCPA before certain marketing texts may be sent to a mobile telephone line.  Other federal statutes have opt-out rather than opt-in consent requirements.  For instance, under CAN-SPAM, marketing emails – or emails sent for the primary purpose of advertising or promoting a commercial product or service – may be sent to those not opting out, provided the sender is accurately identified, the subject line and text of the email are not deceptive, the email contains the name and address of the sender, the email contains a free, simple mechanism to opt out of future emails, and the sender honours opt-outs within 10 days of receipt.

10.2      Are these restrictions only applicable to business-to-consumer marketing, or do they also apply in a business-to-business context?

The TCPA and CAN-SPAM Act apply to both business-to-consumer and business-to-business electronic direct marketing.  In contrast, business-to-business telephone communications, except those intended to induce the retail sale of non-durable office or cleaning supplies, are exempt from the Telemarketing Sales Rule described in question 9.3 below.

10.3      Please describe any legislative restrictions on the sending of marketing via other means (e.g., for marketing by telephone, a national opt-out register must be checked in advance; for marketing by post, there are no consent or opt-out requirements, etc.).

Marketing by telephone is regulated on the national level by the Telemarketing Sales Rule, a regulation under the Telemarketing and Consumer Fraud and Abuse Prevention Act.  This act established the national Do Not Call list of telephone numbers that cannot be used for marketing communications (calls and texts) and disclosure requirements for companies engaging in telephone marketing.  It also proscribes limitations on the use of telephone marketing, including, for instance, limiting the time of day for marketing calls, requiring the caller to provide an opt-out of future calls, and limiting the use of pre-recorded messages.  There are no consent or opt-out requirements for sending marketing materials through postal mail.  In addition, with the growing prevalence of telemarketers using spoofed caller IDs, the FCC is becoming more aggressive with its enforcement of the Truth in Caller ID Act.

It is noted that the FTC, which regulates deceptive practices, has brought enforcement actions relating to the transmission of marketing emails or telemarketing calls by companies who have made promises in their publicly posted privacy policies that personal information will not be used for marketing purposes.  Additionally, many states apply deceptive practices statutes to impose penalties or injunctive relief in similar circumstances, or where violation of a federal statute is deemed a deceptive practice under state law.  Finally, comprehensive state data privacy laws set to go into effect in 2023 in California, Virginia, Colorado, Utah, and Connecticut offer consumers an opt-out of sale, disclosure, or processing of personal information in relation to targeted advertising or profiling.  Although we are yet to see the impact of these provisions on the advertising ecosystem, this will likely prove to be a space to watch over the coming years.

10.4      Do the restrictions noted above apply to marketing sent from other jurisdictions?

Yes, if the recipient is within the United States.

10.5      Is/are the relevant data protection authority(ies) active in enforcement of breaches of marketing restrictions?

The FTC, FCC, and the Attorneys General of the states are active in enforcement in this area.

10.6      Is it lawful to purchase marketing lists from third parties? If so, are there any best practice recommendations on using such lists?

Yes; however, the purchaser of the list should “scrub” it against the national Do Not Call list and the purchaser’s email opt-out lists.  Some states forbid the sale of email addresses of individuals who have opted out of receiving marketing emails, and some forbid the sale of information obtained in connection with a consumer’s purchase transaction.

10.7      What are the maximum penalties for sending marketing communications in breach of applicable restrictions?

The penalties under CAN-SPAM can range from US$16,000 to US$46,517 per email.  The penalties under the TCPA are US$500 per telephone call/text message violation, US$1,500 for each wilful or knowing violation, and additional civil forfeiture fees of up to US$10,000 for intentional violations (based on the TRACED Act, passed in 2019), plus fines that can reach US$16,000 for each political message or call sent in violation of the Act.  By way of example, the FTC and the attorneys general of several states obtained a judgment of US$280 million in 2017 for a company’s repeated violation (involving over 66 million calls) of the TCPA, the FTC’s Telemarketing Sales Rule, and state law.  Similarly, in March 2021, the FCC issued a US$225 million fine—the largest in the history of the agency—against telemarketers based in Texas for violations of the TCPA and the Truth in Caller ID Act in connection with approximately 1 billion robocalls. 

Many states have their own deceptive practices statutes, which impose additional state penalties where violations of federal statutes are deemed to be deceptive practices under the state statute.

11. Cookies

11.1      Please describe any legislative restrictions on the use of cookies (or similar technologies).

The federal Computer Fraud and Abuse Act has been used to assert legal claims against the use of cookies for behavioural advertising, where the cookies enable “deep packet” inspection of the computer on which they are placed.  At least two states, California and Delaware, require disclosures to be made where cookies are used to collect information about a consumer’s online activities across different websites or over time.  The required disclosure must include how the operator responds to so-called “do not track” signals or other similar mechanisms.

In addition, the FTC Act and state deceptive practices acts have underpinned regulatory enforcement and private class action lawsuits against companies that failed to disclose or misrepresented their use of tracking cookies.  One company settled an action in 2012 with a payment of US$22.5 million to the FTC, and in 2016 agreed to pay US$5.5 million to settle a private class action involving the same conduct.

11.2      Do the applicable restrictions (if any) distinguish between different types of cookies? If so, what are the relevant factors?

The Computer Fraud and Abuse Act and the Electronic Communications Privacy Act, as well as state surveillance laws, may come into play where cookies collect information from the computer on which they are placed and report that information to the entity placing the cookies without proper consent.

11.3      To date, has/have the relevant data protection authority(ies) taken any enforcement action in relation to cookies?

Yes, the FTC has brought regulatory enforcement actions against companies that failed to disclose or misrepresented their use of cookies.

11.4      What are the maximum penalties for breaches of applicable cookie restrictions?

Maximum fines are not set by statute.

12. Restrictions on International Data Transfers

12.1      Please describe any restrictions on the transfer of personal data to other jurisdictions.

The U.S. does not place restrictions on the transfer of personal data to other jurisdictions.

12.2      Please describe the mechanisms businesses typically utilise to transfer personal data abroad in compliance with applicable transfer restrictions (e.g., consent of the data subject, performance of a contract with the data subject, approved contractual clauses, compliance with legal obligations, etc.).

This is left to the discretion of the company, as the U.S. does not place restrictions on the transfer of personal data to other jurisdictions.  With respect to receiving data from abroad, prior to Schrems II, the EU-US Privacy Shield Framework provided a mechanism to comply with data protection requirements when transferring personal data from the European Union to the United States.  However, since the invalidation of the Privacy Shield Framework in Schrems II, the mechanisms to govern data transfers from the EU to the U.S. are limited largely to use of SCCs, BCRs, or derogations.

12.3      Do transfers of personal data to other jurisdictions require registration/notification or prior approval from the relevant data protection authority(ies)? Please describe which types of transfers require approval or notification, what those steps involve, and how long they typically take.

No such registration/notification is required.

12.4      What guidance (if any) has/have the data protection authority(ies) issued following the decision of the Court of Justice of the EU in Schrems II (Case C‑311/18)?

Although the FTC has not issued formal guidance following the decision in Schrems II, it has nevertheless provided an update stating that it continues “to expect companies to comply with their ongoing obligations with respect to transfers made under the Privacy Shield Framework”, and encouraging those businesses to adhere to “robust privacy principles”. 

Additionally, the Department of Commerce, Department of Justice, and the Office of the Director of National Intelligence issued a White Paper in September 2020 that provides guidance in light of the Schrems II decision.  This White Paper provides a framework to inform companies’ assessment of the protections afforded by U.S. law in connection with relying on SCCs and advice to companies who have received orders authorised under FISA 702 requiring the disclosure of data to U.S. intelligence agencies. 

On March 25, 2022, the United States and the European Commission announced that they had reached an agreement in principle to replace the Privacy Shield Framework with a new data transfer framework, the Trans-Atlantic Data Privacy Framework. Under this framework, the United States has committed to strengthen privacy and civil liberties safeguards governing signals intelligence activities, establish a multi-layer redress mechanism including an independent Data Protection Review Court available to EU citizens, and enhance oversight. These commitments will be included in an Executive Order that the European Commission will consider as part of a future adequacy decision.  

12.5      What guidance (if any) has/have the data protection authority(ies) issued in relation to the European Commission’s revised Standard Contractual Clauses published on 4 June 2021?

While public authorities in the U.S. have not issued formal guidance in relation to the European Commission’s revised SCCs, the U.S. did submit comments on the draft SCCs issued in November 2020.  The comments do not provide any specific guidance for companies, but rather reflect a concern that the draft revised SCCs may interfere with government efforts to protect public safety and national security along with joint US-EU cooperation on these issues.  The U.S. also remains concerned with the ways that the draft revised SCCs create different standards for data requests by the U.S. government in comparison to similar requests from EU Member States.

13. Whistle-blower Hotlines

13.1      What is the permitted scope of corporate whistle-blower hotlines (e.g., restrictions on the types of issues that may be reported, the persons who may submit a report, the persons whom a report may concern, etc.)?

The federal Whistleblower Protection Act of 1989 protects federal employees, and some states have similar statutes protecting state employees.  Public companies subject to the Sarbanes-Oxley Act also are required to have a whistle-blower policy which must be approved by the board of directors and create a procedure for receiving complaints from whistle-blowers.

13.2      Is anonymous reporting prohibited, strongly discouraged, or generally permitted? If it is prohibited or discouraged, how do businesses typically address this issue?

Anonymous reporting generally is permitted.  Rule 10A-3 of the Securities Exchange Act of 1934, for example, requires that audit committees of publicly listed companies establish procedures for the confidential, anonymous submission by employees of concerns regarding questionable accounting or auditing matters.

14. CCTV

14.1      Does the use of CCTV require separate registration/notification or prior approval from the relevant data protection authority(ies), and/or any specific form of public notice (e.g., a high-visibility sign)?

The use of CCTV must comply with federal and state criminal voyeurism/eavesdropping statutes, some of which require signs to be posted where video monitoring is taking place, restrict the use of hidden cameras, or prohibit videotaping altogether if the location is inherently private (including places were individuals typically get undressed, such as bathrooms, hotel rooms and changing rooms).

14.2      Are there limits on the purposes for which CCTV data may be used?

There generally are no restrictions on the use of lawfully collected CCTV data, subject to a company’s own stated policies or labour agreements.

15. Employee Monitoring

15.1      What types of employee monitoring are permitted (if any), and in what circumstances?

Employee privacy rights, like those of any individual, are based on the principle that an individual has an expectation of privacy unless that expectation has been diminished or eliminated by context, agreement, notice, or statute.  Monitoring of employees generally is permitted to the same extent as it is with the public, including when the employer makes clear disclosure regarding the type and scope of monitoring in which it engages, and subject to generally applicable surveillance laws regarding inherently private locations as well as employee-specific laws such as those regarding the privacy of union member activities.

15.2      Is consent or notice required? Describe how employers typically obtain consent or provide notice.

Consent and notice rights are state-specific, as is the use of hidden cameras.  When required or voluntarily obtained, employers typically obtain consent for employee monitoring through acceptance of employee handbooks, and may provide notice by appropriately posting signs.

15.3      To what extent do works councils/trade unions/employee representatives need to be notified or consulted?

The National Labor Relations Act prohibits employers from monitoring their employees while they are engaged in protected union activities.

15.4      Are employers entitled to process information on an employee’s COVID-19 vaccination status?

Yes.  There are no laws prohibiting employers from requesting information or documentation on an employee’s COVID-19 vaccination status.  Under the Americans with Disabilities Act, employers are required to keep medical information, such as vaccination status, confidential and stored separately from an employee’s personnel file.

16. Data Security and Data Breach

16.1      Is there a general obligation to ensure the security of personal data? If so, which entities are responsible for ensuring that data are kept secure (e.g., controllers, processors, etc.)?

In the consumer context, the FTC has stated that a company’s data security measures for protecting personal data must be “reasonable”, taking into account numerous factors, to include the volume and sensitivity of information the company holds, the size and complexity of the company’s operations, and the cost of the tools that are available to address vulnerabilities.  Certain federal statutes and certain individual state statutes also impose an obligation to ensure security of personal information.  For example, the GLBA and HIPAA impose security requirements on financial services and covered healthcare entities (and their vendors).  In 2021, the FTC announced its revisions to its Safeguards Rule under GLBA with major updates to take effect in December 2022. The updated rule requires highly prescriptive safeguards including a written incident response plan, penetration testing and vulnerability assessments, encryption of customer information, and multi-factor authentication, among other safeguards.  Some states impose data security obligations on certain entities that collect, hold or transmit limited types of personal information.  For example, the New York Department of Financial Services (NYDFS) adopted regulations in 2017 that obligate all “regulated entities” to adopt a cybersecurity programme and cybersecurity governance processes.  The regulations also mandate reporting of cybersecurity events, like data breaches and attempted infiltrations, to regulators.  Covered entities include those banks, mortgage companies, insurance companies, and cheque-cashers otherwise regulated by the NYDFS.  Enforcement of the NYDFS regulation began in early 2021. In the first half of the year, NYDFS reached three separate settlements with fines totalling $US6.3 million.

16.2      Is there a legal requirement to report data breaches to the relevant data protection authority(ies)? If so, describe what details must be reported, to whom, and within what timeframe. If no legal requirement exists, describe under what circumstances the relevant data protection authority(ies) expect(s) voluntary breach reporting.

At the federal level, other than breach notification requirements pertaining to federal agencies themselves, HIPAA requires “Covered Entities” to report impermissible uses or disclosures that compromise the security or privacy of protected health information to the Department of Health and Human Services.  Under the Privacy Rule, if the breach involves more than 500 individuals, such notification must be made within 60 days of discovery of the breach.  Information to be submitted includes information about the entity suffering the breach, the nature of the breach, the timing (start and end) of the breach, the timing of discovery of the breach, the type of information exposed, safeguards in place prior to the breach, and actions taken following the breach, including notifications sent to impacted individuals and remedial actions.

While not specifically a data breach notification obligation, the Securities and Exchange Act and associated regulations, including Regulation S-K, require public companies to disclose in filings with the Securities and Exchange Commission when material events, including cyber incidents, occur.  To the extent cyber incidents pose a risk to a registrant’s ability to record, process, summarise and report information that is required to be disclosed in SEC Commission filings, management should also consider whether there are any deficiencies in its disclosure controls and procedures that would render them ineffective. In early 2022, the SEC proposed rules that would reporting of material cybersecurity incidents mandatory, including updates about previously reported incidents.

Some state statutes require the reporting of data breaches to a state agency or attorney general under certain conditions.  The information to be submitted varies by state but generally includes a description of the incident, the number of individuals impacted, the types of information exposed, the timing of the incident and the discovery, actions taken to prevent future occurrences, copies of notices sent to impacted individuals, and any services offered to impacted individuals, such as credit monitoring.

16.3      Is there a legal requirement to report data breaches to affected data subjects? If so, describe what details must be reported, to whom, and within what timeframe. If no legal requirement exists, describe under what circumstances the relevant data protection authority(ies) expect(s) voluntary breach reporting.

At the federal level, HIPAA requires covered entities to report data breaches to impacted individuals without unreasonable delay, and in no case later than 60 days.  Notice should include a description of the breach, to include: the types of information that were involved; the steps individuals should take to protect themselves, including who they can contact at the covered entity for more information; as well as what the covered entity is doing to investigate the breach, mitigate the harm, and prevent further breaches.  For breaches affecting more than 500 residents of a state or jurisdiction, covered entities must provide local media notice, in addition to individual notices.

As of May 2018, all 50 states, the District of Columbia, Guam, Puerto Rico and the U.S. Virgin Islands have statutes that require data breaches to be reported, as defined in each statute, to impacted individuals.  These statutes are triggered by the exposure of personal information of a resident of the jurisdiction, so if a breach occurs involving residents of multiple states, then multiple state laws must be followed.  Most statutes define a “breach of the security of the system” as involving unencrypted computerised personal information, but some states include personal information in any format.  Triggering personal information varies by statute, with most including an individual’s first name or first initial and last name, together with a data point, including the individual’s Social Security Number, driver’s licence or state identification card number, financial account number or payment card information.  Some states include additional triggering data points, such as date of birth, mother’s maiden name, passport number, biometric data, employee identification number or username and password.  The standard for when notification is required varies from unauthorised access to personal information, to unauthorised acquisition of personal information, to misuse of or risk of harm to personal information.  Most states require notification as soon as is practical, and often within 30 to 60 days of discovery of the incident, depending on the statute.  The information to be submitted varies by state but generally includes a description of the incident, the types of information exposed, the timing of the incident and its discovery, actions taken to prevent future occurrences, information about steps individuals should take to protect themselves, information resources, and any services offered to impacted individuals such as credit monitoring.

16.4      What are the maximum penalties for data security breaches?

Penalties are statute- and fact-specific.  Under HIPAA, for example, monetary fines can range from US$100 to US$50,000 per violation (or per record), with a maximum penalty of US$1.75 million per year for each violation.  By way of example, in 2020, the HHS and the attorneys general of 42 states entered into a US$39.5 million settlement with a health insurer in relation to a data breach affecting the health records of over 79 million individuals.  Marking the current high point for enforcement, in 2019, a company agreed to pay a record penalty of at least US$575 million, and potentially up to US$700 million in a data breach settlement reached with the FTC, the CFPB, 48 states, the District of Columbia, and the Commonwealth of Puerto Rico.

17. Enforcement and Sanctions

17.1      Describe the enforcement powers of the data protection authority(ies).

The U.S. does not have a central data protection authority, as such, the enforcement powers of the regulators will depend on the specific statute in question.  Some laws only permit federal government enforcement, some allow for federal or state government enforcement, and some allow for enforcement through a private right of action by aggrieved consumers.  Whether the sanctions are civil and/or criminal depends on the relevant statute.  For example, HIPAA enforcement permits the imposition of civil and criminal penalties.  While HIPAA’s civil remedies are enforced at the federal level by HHS, and at the state level by Attorneys General, the U.S. Department of Justice (USDOJ) is responsible for criminal prosecutions under HIPAA. At the state level the California Privacy Protection Agency will have the power to enforce consumer rights and business obligations under the CPRA.

1. Investigative Powers: Depending on the applicable data protection laws, regulators in the U.S. may have the authority to conduct investigations into potential violations of data protection requirements. 
2. Corrective Powers: Depending on the applicable data protection laws, regulators in the U.S. may have the authority correct non-compliance actions of businesses through injunctive relief or under consent orders.
3. Authorisation and Advisory Powers: Depending on the applicable data protection laws, regulators in the U.S. will often provide a method for businesses to consult with the regulators for additional and specific guidance.
4. Imposition of administrative fines for infringements of specified GDPR provisions: This is not relevant for our jurisdiction.
5. Non-compliance with a data protection authority: Depending on the applicable data protection laws, non-compliance with a data protection authority will generally attract renewed or additional enforcement against the business.

17.2      Does the data protection authority have the power to issue a ban on a particular processing activity? If so, does such a ban require a court order?

The U.S. does not have a central data protection authority.  Enforcement authority, including whether a regulator may ban a particular processing activity, is specified in the relevant statutes.  For example, eighteen states have adopted the Insurance Data Security Model Law developed by the National Association of Insurance Commissioners.  Among other things, these laws empower state insurance commissioners to issue cease-and-desist orders pertaining to data processing violations in the insurance industry, and even to suspend or revoke an insurance institution’s or agent’s licence to operate.

17.3      Describe the data protection authority’s approach to exercising those powers, with examples of recent cases.

In the U.S., this depends on the relevant statutory enforcement mechanism and the agency conducting the enforcement measures.  The FTC, for example, in addition to publishing on its website all of the documents filed in FTC cases and proceedings, publishes an annual summary of key data privacy and data security enforcement actions and settlements, which provides guidance to businesses on its enforcement priorities.  Similarly, HHS publishes enforcement highlights, summarises the top compliance issues alleged across all complaints and, by law, maintains a website that lists mandatorily reported breaches of unsecured protected health information affecting 500 or more individuals.

17.4      Does the data protection authority ever exercise its powers against businesses established in other jurisdictions? If so, how is this enforced?

Extraterritorial enforcement of a U.S. law would depend on a number of factors, including whether the entity is subject to the jurisdiction of the U.S. courts, the impact on U.S. commerce and the impact on U.S. residents, among other factors.

18. E-discovery / Disclosure to Foreign Law Enforcement Agencies

18.1      How do businesses typically respond to foreign e-discovery requests, or requests for disclosure from foreign law enforcement agencies?

When made pursuant to Mutual Legal Assistance Treaties, information requests are typically processed through the USDOJ, which works with the local U.S. Attorney’s Office and local law enforcement, prior to review by a federal judge and service on the U.S. company.

18.2      What guidance has/have the data protection authority(ies) issued?

Guidance is agency-specific, and there is no central data protection authority.  By way of example, the FTC has issued guidance on a variety of issues including children’s privacy, identity theft and telemarketing.  Some state Attorneys General have also offered resources on their websites for victims of identity theft and for companies suffering data security breaches.

19. Trends and Developments

19.1      What enforcement trends have emerged during the previous 12 months? Describe any relevant case law or recent enforcement actions.

The FTC remained active in regulating data security and privacy issues in 2021.  In early 2021, the FTC finalized a settlement with a   videoconferencing company accused of participating in unfair and deceptive practices regarding user security. As part of the settlement agreement, the company must make changes to its security policies, continuously review its software updates for security flaws, and obtain biannual assessments of its security programs by an FTC-approved independent third party.  In March 2022, the FTC proposed a similar settlement in its action against an online customized merchandise platform accused of failing to secure consumers’ sensitive personal data and of covering up a major data breach. Notably, the settlement requires that the company implement certain safeguards such as multi-factor authentication and data minimisation policies.  These settlements are indicative of the changes that the FTC has made to improve its data security related orders.  Their approach has been to (1) make the orders more specific about the security measure the FTC expects companies to implement, (2) increase accountability of third-party compliance assessors, and (3) require that data security concerns be elevated to companies’ boards or other such governing bodies.  In addition, the FTC’s Commissioners have continued to emphasise their commitment to pursuing enforcement actions against companies that engage in unfair or unreasonable privacy and data security practices.  In doing so, however, the Commissioners have recognised the potential limits of their authority, due in part to courts confirming limitation on the FTC’s ability to impose penalties on companies, and have called on Congress to enact legislation supplementing these powers or, alternatively, a national privacy law that would be enforceable by the FTC.  The FTC has also indicated that it will initiate rulemaking proceedings in an attempt to expand its enforcement authority in the areas artificial intelligence, privacy and cybersecurity.

The FTC also continued to increase its efforts to enforce obligations for the protection of children’s privacy under the Children’s Online Privacy Protection Act (COPPA). In 2021, the FTC entered into settlements with an online ad exchange platform and a children’s app developer for US$2 million and US$3 million, respectively, for alleged violations of COPPA.

As described above, the FCC has become more aggressive in its enforcement of the Truth in Caller ID Act and issued its largest ever fine of US$225 million against health insurance telemarketers for making one billion illegally spoofed robocalls. HHS continued to face challenges in 2021 relating to the COVID-19 pandemic. Due to rapid growth of the telehealth model, HHS necessarily provided flexibility in its enforcement of HIPAA to ensure continued access to healthcare.  To this end, in 2020, HHS issued NDEs (Notification of Enforcement Discretion) to healthcare providers so long as they exercised good-faith use of videoconferencing while providing telehealth services to patients.  Nevertheless, Q3 and Q4 of 2020 saw the return of HHS’s active enforcement, which continued through 2021, with the regulator issuing a US$5.1million penalty under HIPAA in relation to a malware attack that compromised the personal data of over 9.3 million people. 

2021 saw a notable increase in cybersecurity enforcement activities by the Securities and Exchange Commission (SEC). First, in June 2021, the SEC announced a nearly US$500,000 settlement , with a real estate settlement service provider for allegedly failing to maintain sufficient disclosure controls and procedures regarding a cybersecurity vulnerability that had exposed 800 million images, some of which included customer personal information. In August 2021, the SEC announced an US$1 million settlement with an educational publishing company based in London for inaccurate and incomplete cyber disclosures and deficient disclosure controls. Finally, also in August 2021, the SEC announced that it had sanctioned eight firms in three actions for alleged deficient cybersecurity policies and procedures that resulted in unauthorized access to firm email accounts, exposing customer personal information. The firms settled the three actions with penalties totalling US$750,000.

In October 2021, the DOJ announced a new Civil Cyber-Fraud initiative to pursue cybersecurity-related fraud by government contractors and grant recipients under the False Claims Act. In March 2022, the DOJ entered into its first settlement for nearly US$1 million with a global medical services provider for misrepresenting to the State Department that it met contractual requirements to maintain a HIPAA-compliant electronic medical records system, while knowing that the system contained data security gaps.  

In addition, in August 2020, the DOJ charged a ride-sharing company’s Chief Security Officer with “obstruction of justice and misprision of a felony in connection with an alleged attempted cover-up of a 2016 data breach”.  In December 2021, charges of wire fraud were added as part of a superseding indictment. Although this case is ongoing, its resolution will be a significant signal to inform company responses to data breaches.

State Attorneys General also played a key role in bringing enforcement actions under specific state laws in 2021.  For example, in March 2021, 41 Attorneys General entered into an agreement with a medical debt collection agency following major 2019 data breach, which affected up to 21 million individuals across the United States.  Under the agreement, the agency is required to implement and maintain a number of data security practices and may be liable for a US$21 million payment to the states if the agency violates the agreement.

Finally, class action litigation under the Illinois Biometric Privacy Act (BIPA) continued to persist in 2021, as U.S. courts approved class-wide settlements as high as US$650 million, US$92 million, and US$36 million for alleged violations of the statute. Overall, there was an increase in BIPA settlements in 2021 compared to 2020. This trend is expected to continue in 2022.

19.2      What “hot topics” are currently a focus for the data protection regulator?

We anticipate that the following topics will remain hot over the next year: state-level consumer data privacy law initiatives will continue to proliferate as more states move laws through their legislatures, possibly driving action at the federal-level, including possible rulemaking proceedings by the FTC;  issues surrounding the collection and protection of biometric information (especially in relation to student privacy); consumer access to financial relief and other remedies when their data protection rights are violated, even in the absence of a showing of harm; issues surrounding AdTech and targeted behavioural advertising;  issues relating to automated decision making fueled by artificial intelligence and machine learning; an increased focus by legislators and regulators alike on cybersecurity issues, particularly in the wake of data breaches and ransomware attacks involving significant technology vendor software and industrial operations; and targeting of cryptocurrency and digital assets such as non-fungible tokens by cybercriminals.