# Data Protection Law: An Overview > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/crs%3AR45631 ## Record - **Collection:** Congressional research report - **Document type:** CRS Report - **Published:** March 25, 2019 - **Citation:** R45631 ## Text Data Protection Law: An Overview Stephen P. Mulligan Legislative Attorney Chris D. Linebaugh Legislative Attorney March 25, 2019 Congressional Research Service 7-.... www.crs.gov R45631 SUMMARY Data Protection Law: An Overview Recent high-profile data breaches and other concerns about how third parties protect the privacy of individuals in the digital age have raised national concerns over legal protections of Americans’ electronic data. Intentional intrusions into government and private computer networks and inadequate corporate privacy and cybersecurity practices have exposed the personal information of millions of Americans to unwanted recipients. At the same time, internet connectivity has increased and varied in form in recent years. Americans now transmit their personal data on the internet at an exponentially higher rate than in the past, and their data are collected, cultivated, and maintained by a growing number of both “consumer facing” and “behind the scenes” actors such as data brokers. As a consequence, the privacy, cybersecurity and protection of personal data have emerged as a major issue for congressional consideration. R45631 March 25, 2019 Stephen P. Mulligan Legislative Attorney -re-acte--@crs.loc.gov Chris D. Linebaugh Legislative Attorney -re-acte--@crs.loc.gov For a copy of the full report, please call 7-.... or visit www.crs.gov. Despite the rise in interest in data protection, the legislative paradigms governing cybersecurity and data privacy are complex and technical, and lack uniformity at the federal level. The constitutional “right to privacy” developed over the course of the 20th century, but this right generally guards only against government intrusions and does little to shield the average internet user from private actors. At the federal statutory level, there are a number of statutes that protect individuals’ personal data or concern cybersecurity, including the Gramm-Leach-Bliley Act, Health Insurance Portability and Accountability Act, Children’s Online Privacy Protection Act, and others. And a number of different agencies, including the Federal Trade Commission (FTC), the Consumer Finance Protection Bureau (CFPB), and the Department of Health and Human Services (HHS), enforce these laws. But these statutes primarily regulate certain industries and subcategories of data. The FTC fills in some of the statutory gaps by enforcing a broad prohibition against unfair and deceptive data protection practices. But no single federal law comprehensively regulates the collection and use of consumers’ personal data. Seeking a more fulsome data protection system, some governments—such as California and the European Union (EU)—have recently enacted privacy laws regulating nearly all forms of personal data within their jurisdictional reach. Some argue that Congress should consider creating similar protections in federal law, but others have criticized the EU and California approaches as being overly prescriptive and burdensome. Should the 116th Congress consider a comprehensive federal data protection law, its legislative proposals may involve numerous decision points and legal considerations. Points of consideration may include the conceptual framework of the law (i.e., whether it is prescriptive or outcome-based), the scope of the law and its definition of protected information, and the role of the FTC or other federal enforcement agency. Further, if Congress wants to allow individuals to enforce data protection laws and seek remedies for the violations of such laws in court, it must account for standing requirements in Article III, Section 2 of the Constitution. Federal preemption also raises complex legal questions—not only of whether to preempt state law, but what form of preemption Congress should employ. Finally, from a First Amendment perspective, Supreme Court jurisprudence suggests that while some privacy, cybersecurity, or data security regulations are permissible, any federal law that restricts protected speech, particularly if it targets specific speakers or content, may be subject to more stringent review by a reviewing court. Congressional Research Service Data Protection Law: An Overview Contents Origins of American Privacy Protections ........................................................................................ 3 The Common Law and the Privacy Torts .................................................................................. 3 Constitutional Protections and the Right to Privacy ................................................................. 5 Federal Data Protection Law ........................................................................................................... 7 Gramm-Leach-Bliley Act (GLBA) ........................................................................................... 8 Health Insurance Portability and Accountability Act (HIPAA) .............................................. 10 Fair Credit Reporting Act (FCRA) .......................................................................................... 12 The Communications Act ........................................................................................................ 14 Common Carriers .............................................................................................................. 14 Cable Operators and Satellite Carriers .............................................................................. 17 Video Privacy Protection Act .................................................................................................. 19 Family Educational Rights and Privacy Act (FERPA) ............................................................ 20 Federal Securities Laws .......................................................................................................... 21 Children’s Online Privacy Protection Act (COPPA) ............................................................... 24 Electronic Communications Privacy Act (ECPA) ................................................................... 25 Computer Fraud and Abuse Act (CFAA) ................................................................................ 29 Federal Trade Commission Act (FTC Act) ............................................................................. 30 Consumer Financial Protection Act (CFPA) ........................................................................... 35 State Data Protection Law ............................................................................................................. 36 The California Consumer Privacy Act (CCPA)....................................................................... 38 The CCPA’s Scope............................................................................................................ 38 The CCPA’s Provisions and Requirements....................................................................... 38 Remedies, Liabilities, and Fines ....................................................................................... 39 The CCPA and the 116th Congress ......................................................................................... 39 The EU’s General Data Protection Regulation (GDPR) ............................................................... 40 European Data Privacy Laws and the Lead-Up to the GDPR .......................................... 41 GDPR Provisions and Requirements ...................................................................................... 42 Scope and Territorial Reach .............................................................................................. 42 Key Principles ................................................................................................................... 43 Bases for Processing and Consent Requirements ............................................................. 43 Individual Rights and Corresponding Obligations............................................................ 44 Data Governance and Security.......................................................................................... 46 Data Breach Notifications ................................................................................................. 47 Data Transfer Outside the EU ........................................................................................... 48 Remedies, Liability, and Fines .......................................................................................... 50 The GDPR and the 116th Congress ........................................................................................ 50 The Trump Administration’s Proposed Data Privacy Policy Framework ..................................... 51 Considerations for Congress.......................................................................................................... 54 Prescriptive Versus Outcome-Based Approach ....................................................................... 55 Defining Protected Information and Addressing Statutory Overlap ....................................... 56 Agency Enforcement ............................................................................................................... 57 Private Rights of Action and Standing .................................................................................... 59 Preemption .............................................................................................................................. 62 First Amendment ..................................................................................................................... 64 Conclusion ..................................................................................................................................... 69 Congressional Research Service Data Protection Law: An Overview Appendixes Appendix. Summary of Federal Data Protection Laws ................................................................. 71 Contacts Author Contact Information .......................................................................................................... 75 Congressional Research Service Data Protection Law: An Overview ecent high-profile data breaches and privacy violations have raised national concerns over the legal protections that apply to Americans’ electronic data.1 While some concern over data protection2 stems from how the government might utilize such data, mounting worries have centered on how the private sector controls digital information,3 the focus of this report. Inadequate corporate privacy practices4 and intentional intrusions into private computer networks5 have exposed the personal information of millions of Americans. At the same time, internet connectivity has increased and varied in form in recent years, expanding from personal computers and mobile phones to everyday objects such as home appliances, “smart” speakers, vehicles, and other internet-connected devices.6 R Americans now transmit their personal data on the internet at an exponentially higher rate than the past.7 Along with the increased connectivity, a growing number of “consumer facing” actors 1 See, e.g., Aaron Smith, Americans and Cybersecurity, PEW RESEARCH CTR. (Jan. 26, 2017), http://www.pewinternet.org/2017/01/26/americans-and-cybersecurity/ (“This survey finds that a majority of Americans have directly Experienced some form of data theft or fraud, that a sizeable share of the public thinks that their personal data have become less secure in recent years, and that many lack confidence in various institutions to keep their personal data safe from misuse.”). 2 As discussed in more detail infra § Considerations for Congress, the term “data protection” in this report refers to both data privacy (i.e., how companies collect, use, and disseminate personal information) and data security (i.e., how companies protect personal information from unauthorized access or use and respond to such unauthorized access or use). Although data privacy and data security present distinct challenges and are discussed separately in this report when appropriate, legislation addressing these fields increasingly has been unified into the singular field of data protection. See, e.g., ANDREW BURT & ANDREW E. GEER, JR., STANFORD UNIV., HOOVER INST., AEGIS SERIES PAPER NO. 1816, FLAT LIGHT: DATA PROTECTION FOR THE DISORIENTED, FROM POLICY TO PRACTICE 9 (2018) (“What we call ‘privacy’ and ‘security’ are now best and jointly described as ‘data protection.’”); Woodrow Hartzog & Daniel J. Solove, The Scope and Potential of FTC Data Protection, 83 GEO. WASH. L. REV. 2230, 2232 (2015) (referring to data privacy and security as “two related areas that together we will refer to as ‘data protection.’”). 3 See, e.g., U.S. GOV’T ACCOUNTABILITY OFFICE, GAO-19-52, INTERNET PRIVACY: ADDITIONAL FEDERAL AUTHORITY COULD ENHANCE CONSUMER PROTECTION AND PROVIDE FLEXIBILITY 16-17 (2019) [hereinafter GAO-19-52] (discussing public opinion surveys related to public concerns over the protection of consumer data). 4 See, e.g., Paul Grewal, Deputy Vice President and General Counsel, Facebook, Suspending Cambridge Analytica and SCL Group from Facebook, FACEBOOK (last updated Mar. 17, 2017, 9:50 AM PT), https://newsroom.fb.com/news/ 2018/03/suspending-cambridge-analytica/ (reporting that the data analytics firm Cambridge Analytica exposed private user information by violating Facebook’s privacy platform). In addition to violations of privacy protocols, Facebook recently reported that hackers have intentionally infiltrated its private networks. See Guy Rosen, Vice President of Product Management, Facebook, Security Update, FACEBOOK (Sept. 28, 2018), https://newsroom.fb.com/news/2018/ 09/security-update/ (reporting that hackers exploited a vulnerability in Facebook’s code affecting nearly 50 million accounts). 5 Large-scale intrusions into private networks have occurred at a variety of companies, including Equifax, Yahoo, Sony, Target, and Home Depot. See CRS Report R43496, The Target and Other Financial Data Breaches: Frequently Asked Questions, by N. Eric Weiss and Rena S. Miller; Anna Maria Andriotis, Robert McMillan and Christina Rexrode, Equifax Hack Leaves Consumers, Financial Firms Scrambling, WALL ST. J., Sept. 8, 2017, https://www.wsj.com/articles/equifax-hack-leaves-consumers-financial-firms-scrambling-1504906993. 6 See Joshua D. Wright, Comm’r, Fed. Trade Comm’n, Remarks at the U.S. Chamber of Commerce 7–8 (May 21, 2015), https://www.ftc.gov/system/files/documents/public_statements/644381/150521iotchamber.pdf (stating that “[r]esearchers have estimated 900 million devices were connected to the Internet in 2009, increasing to 8.7 billion devices in 2012, and now up to 14 billion devices today,” and describing predictions that between 25 billion and 50 billion devices will be connected to the “Internet of Things” by 2020). For background on the “Internet of Things” see CRS Report R44227, The Internet of Things: Frequently Asked Questions, by Eric A. Fischer. 7 For statistics on the increasing use of computers and the internet in American homes, see CAMILLE RYAN, U.S. CENSUS BUREAU, COMPUTER AND INTERNET USE IN THE UNITED STATES: 2016, AMERICAN COMMUNITY SURVEY REPORTS 39 (Aug. 2018), https://www.census.gov/content/dam/Census/library/publications/2018/.../ACS-39.pdf and Internet Broadband Fact Sheet, PEW RESEARCH CTR. (Feb. 5, 2018), http://www.pewinternet.org/fact-sheet/internetbroadband/. See also GAO-19-52, supra note 3, at 5–6 (summarizing recent statistics on internet usage in the United States). Congressional Research Service 1 Data Protection Law: An Overview (such as websites) and “behind the scenes” actors (such as data brokers and advertising companies) collect, maintain, and use consumers’ information.8 While this data collection can benefit consumers—for instance, by allowing companies to offer them more tailored products—it also raises privacy concerns, as consumers often cannot control how these entities use their data.9 As a consequence, the protection of personal data has emerged as a major issue for congressional consideration.10 Despite the increased interest in data protection, the legal paradigms governing the security and privacy of personal data are complex and technical, and lack uniformity at the federal level. The Supreme Court has recognized that the Constitution provides various rights protecting individual privacy, but these rights generally guard only against government intrusions and do little to prevent private actors from abusing personal data online.11 At the federal statutory level, while there are a number of data protection statutes, they primarily regulate certain industries and subcategories of data.12 The Federal Trade Commission (FTC) fills in some of the statutory gaps by enforcing the federal prohibition against unfair and deceptive data protection practices.13 But no single federal law comprehensively regulates the collection and use of personal data.14 In contrast to the “patchwork” nature of federal law, some state and foreign governments have enacted more comprehensive data protection legislation.15 Some analysts suggest these laws, which include the European Union’s (EU’s) General Data Protection Regulation (GDPR)16 and state laws such as the California Consumer Privacy Act (CCPA),17 will create increasingly 8 Edith Ramirez, Chairwoman, Fed. Trade Comm’n, Opening Remarks at PrivacyCon 2017 (Jan. 12, 2017), https://www.ftc.gov/system/files/documents/videos/privacycon-2017-part-1/ftc_privacycon_2017__transcript_segment_1.pdf (discussing the growing number of actors involved in compiling user data, including “consumer facing companies” and “behind the scenes” companies); FED. TRADE COMM’N, DATA BROKERS: A CALL FOR TRANSPARENCY AND ACCOUNTABILITY 11–13 (2014), https://www.ftc.gov/system/files/documents/reports/data-brokerscall-transparency-accountability-report-federal-trade-commission-may-2014/140527databrokerreport.pdf [hereinafter DATA BROKERS REPORT] (discussing how data brokers obtain consumer information). 9 DATA BROKERS REPORT, supra note 8, at v–vi (discussing benefits and risk to data brokers’ collection of consumer data). 10 See, e.g., Policy Principles for a Federal Data Privacy Framework in the United States: Hearing before the S. Comm. on Commerce, Science, and Transp., 116th Cong. (2019) [hereinafter Policy Principles Hearing]; Protecting Consumer Privacy in the Era of Big Data: Hearing Before the Subcomm. on Consumer Protection and Commerce of the H. Comm. on Energy and Commerce, 116th Cong. (2019) [hereinafter Era of Big Data Hearing]; Consumer Data Privacy: Examining Lessons from the European Union’s Data Protection Regulation and the California Consumer Privacy Act: Hearing Before the S. Comm. on Commerce, Science, and Transp., 115th Cong. (2018) [hereinafter GDPR and CCPA Hearing]; Examining Safeguards for Consumer Data Privacy: Hearing Before the S. Comm. on Commerce, Science, and Transp., 115th Cong. (2018) [hereinafter Examining Safeguards Hearing]; Examining the Current Data Security and Breach Regulatory Notification Regime: Hearing Before the Subcomm. on Fin. Inst. and Consumer Credit of the H. Comm. on Fin. Servs., 115th Cong. (2018) [hereinafter Current Data Security Hearing]. 11 See infra § Constitutional Protections and the Right to Privacy. 12 See infra § Federal Trade Commission Act (FTC Act). 13 See id. 14 See id. 15 Zachary S. Heck, A Litigator’s Primer on European Union and American Privacy Laws and Regulations, 44 LITIG. 59, 59 (2018) (“[T]he United States has a patchwork of laws at both the federal and state levels relating to data protection and information sharing.”). 16 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation) [hereinafter GDPR]. 17 2018 Cal. Legis. Serv. Ch. 55 (A.B. 375) (West) (codified in CAL. CIV. CODE §§ 1798.100—1798.198). Congressional Research Service 2 Data Protection Law: An Overview overlapping and uneven data protection regimes.18 This fragmented legal landscape coupled with concerns that existing federal laws are inadequate has led many stakeholders to argue that the federal government should assume a larger role in data protection policy.19 However, at present, there is no consensus as to what, if any, role the federal government should play, and any legislative efforts at data protection are likely to implicate unique legal concerns such as preemption, standing, and First Amendment rights, among other issues.20 This report examines the current U.S. legal landscape governing data protection, contrasting the current patchwork of federal data protection laws with the more comprehensive regulatory models in the CCPA and GDPR. The report also examines potential legal considerations for the 116th Congress should it consider crafting more comprehensive federal data protection legislation. The report lastly contains an Appendix, which contains a table summarizing the federal data protection laws discussed in the report. Origins of American Privacy Protections The Common Law and the Privacy Torts Historically, the common law in the United States had little need to protect privacy—as one commentator has observed, “[s]olitude was readily available in colonial America.”21 Although common law had long protected against eavesdropping and trespass,22 these protections said little to nothing about individual rights to privacy, per se. Over time, gradual changes in the technological and social environment caused a shift in the law. In 1890, Louis Brandeis and Samuel Warren published a groundbreaking article in the Harvard Law Review entitled The Right to Privacy.23 Reacting to the proliferation of the press and advancements in technology such as more advanced cameras, the article argued that the law should protect individuals’ “right to privacy” and shield them from intrusion from other individuals. The authors defined this 18 See Developing the Administration’s Approach to Consumer Privacy, 83 Fed. Reg. 48600 (Sept. 26, 2018) (“A growing number of foreign countries, and some U.S. states, have articulated distinct versions for how to address privacy concerns, leading to a nationally and globally fragmented regulatory landscape.”). 19 See, e.g., infra § The Trump Administration’s Proposed Data Privacy Policy Framework (discussing the Trump Administration’s plans to develop a federal data privacy policy); Ben Kochman, Tech Giants Want Uniform Privacy Law, But No GDPR, LAW360 (Sept. 26, 2018), https://www.law360.com/articles/1086064 (“Representatives from Google LLC, Amazon.com Inc., Apple Inc., Twitter Inc., AT&T Inc. and Charter Communications Inc. all said they would support some sort of privacy law that would give consumers more control over the way in which their data is used.”); Harper Neidig, Advocates Draw Battle Lines over National Privacy Law, THE HILL (Nov. 13, 2018), https://thehill.com/policy/technology/416341-advocates-draw-battle-lines-over-national-privacy-law (discussing statement of 34 public interest groups advocating for comprehensive federal data privacy legislation). 20 See infra § Considerations for Congress. 21 Daniel J. Solove, A Brief History of Information Privacy Law, in PROSKAUER ON PRIVACY § 1-4 (2006) (citing DAVID H. FLAHERTY, PRIVACY IN COLONIAL NEW ENGLAND 1 (1972)). 22 See 4 WILLIAM BLACKSTONE, COMMENTARIES ON THE LAWS OF ENGLAND 169 (1769) (“Eaves-droppers, or such as listen under walls or windows, or the eaves of a house, to harken after discourse, and thereupon to frame slanderous and mischievous tales, are a common nuisance . . .”); 3 WILLIAM BLACKSTONE, COMMENTARIES ON THE LAWS OF ENGLAND 208–09 (1769) (discussing trespass). 23 4 HARV. L. REV. 193 (1890). Congressional Research Service 3 Data Protection Law: An Overview emergent right as the “right to be let alone.”24 Scholars have argued that this article created a “revolution” in the development of the common law.25 In the century that followed Brandeis’s and Warren’s seminal article, most states recognized the so-called “privacy torts”—intrusion upon seclusion, public disclosure of private facts, false light or “publicity,” and appropriation.26 These torts revolve around the central idea that individuals should be able to lead, “to some reasonable extent, a secluded and private life.”27 The Supreme Court described this evolution of privacy tort law as part of a “strong tide” in the twentieth century toward the “so-called right of privacy” in the states.28 Despite this “strong tide,” some scholars have argued that these torts, which were developed largely in the mid-twentieth century, are inadequate to face the privacy and data protection problems of today.29 Furthermore, some states do not accept all four of these torts or have narrowed and limited the applicability of the torts so as to reduce their effectiveness.30 As discussed in greater detail below, state common law provides some other remedies and protections relevant to data protection, via tort and contract law.31 However, while all of this state common law may have some influence on data protection, the impact of this judge-made doctrine is unlikely to be uniform, as courts’ application of these laws will likely vary based on the particular facts of the cases in which they are applied and the precedents established in the various states.32 24 Id. at 195–96. 25 Diane L. Zimmerman, Requiem for a Heavyweight: A Farewell to Warren and Brandeis’s Privacy Tort, 68 CORNELL L. REV. 291 (1983). See also Dorothy J. Glancy, The Invention of the Right to Privacy, 21 ARIZ. L. REV. 1, 1 (1979) (noting that the Brandeis and Warren article has done “nothing less than add a chapter to our law”) (quoting Letter from Roscoe Pound to William Chilton (1916)). 26 Solove, supra note 21, § 1-14. 27 RESTATEMENT (SECOND) OF TORTS § 652A (Am. Law Inst. 2018). 28 See Cox Broadcasting Corp. v. Cohn, 420 U.S. 469, 487–88 (1975). 29 See, e.g., Neil M. Richards, The Limits of Tort Privacy, 9 J. on TELECOM & HIGH TECH L. 357, 359–60 (2011) (“For better or for worse, American law currently uses tools developed in the nineteenth and mid-twentieth centuries to deal with these problems of the twenty-first.”); Neil M. Richards & Daniel J. Solove, Prosser’s Privacy Law: A Mixed Legacy, 98 CAL. L. REV. 1887, 1889 (2010); Zimmerman, supra note 25, at 362 (arguing that the privacy torts have “failed to become a useable and effective means of redress for plaintiffs”). 30 See Richards, supra note 29 at 360. 31 See infra § State Data Protection Law. 32 See, e.g., In re Google Inc. Cookie Placement Consumer Privacy Litig., 806 F.3d 125, 150–51 (3d Cir. 2015) (holding that plaintiffs stated a claim under California invasion of privacy law against Google for placement of tracking cookies on users’ browsers); In re Vizio, Inc., Consumer Privacy Litig., 238 F. Supp. 3d 1204 (C.D. Cal. 2017) (although acknowledging that “Courts have been hesitant to extend the tort of invasion of privacy to the routine collection of personally identifiable information as part of electronic communications,” nonetheless concluding that plaintiffs stated a claim for invasion of privacy under California and Massachusetts law against “smart TV” company that collected information on consumer viewing habits); Opperman v. Path, Inc., 205 F. Supp. 3d 1064, 1078–80 (N.D. Cal. 2016) (holding that there was a triable question of fact in invasion of privacy claim under California law against software developer that allegedly improperly uploaded address book data without customers’ consent). But see Low v. LinkedIn Corp., 900 F. Supp. 2d 1010, 1024–25 (N.D. Cal. 2012) (dismissing claim for invasion of privacy under California law against social networking site that allegedly disclosed to third parties information about users browsing on LinkedIn); Dwyer v. American Express Co., 652 N.E.2d 1351, 1353–56 (Ill. App. Ct. 1995) (dismissing claims for invasion of privacy against credit card company for renting lists of consumer purchasing patterns for advertising purposes). Congressional Research Service 4 Data Protection Law: An Overview Constitutional Protections and the Right to Privacy As reflected in the common law’s limited remedies, at the time of the founding, concerns about privacy focused mainly on protecting private individuals from government intrusion rather than on protecting private individuals from intrusion by others.33 Accordingly, the Constitution’s Bill of Rights protects individual privacy from government intrusion in a handful of ways and does little to protect from non-governmental actors. Some provisions protect privacy in a relatively narrow sphere, such as the Third Amendment’s protection against the quartering of soldiers in private homes34 or the Fifth Amendment’s protection against self-incrimination.35 The most general and direct protection of individual privacy is contained in the Fourth Amendment, which states that “[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated . . .”36 For more than 100 years, the Fourth Amendment was generally read to prohibit only entry into private places rather than to provide general right to privacy.37 However, alongside the developments in the common law, constitutional law evolved over time to place a greater emphasis on protecting an individual’s personal privacy. In particular, in 1967, the Supreme Court in Katz v. United States38 explained that the Fourth Amendment, while not creating a general “right to privacy,” nonetheless protected “people, not places,” and guarded individual privacy against certain types of governmental intrusion.39 This principle has continued to evolve over time, and has come to protect, to some extent, individuals’ interest in their digital privacy. For example, in the 2018 case of Carpenter v. United States,40 the Supreme Court concluded that the Fourth Amendment’s protection of privacy extended to protecting some information from government intrusion even where that information was shared with a third party. In Carpenter, the Court concluded that individuals maintain an expectation of privacy, protected by the Fourth Amendment, in the record of their movements as recorded by their cellular provider.41 Carpenter distinguished earlier cases which had relied upon the principle that information shared with third parties was generally not subject to Fourth Amendment scrutiny, concluding that “an individual maintains a legitimate expectation of privacy in the record of his physical movements as captured through [his cellular phone].”42 The Court’s holding means that, in the future, the government 33 Solove, supra note 21, at § 1-4. 34 U.S. CONST. amend. III (forbidding the quartering of soldiers in private homes). 35 Id. amend. V (in part, prohibiting the government from compelling persons toward self-incrimination in criminal cases). 36 Id. amend. IV. 37 See e.g., Olmstead v. United States, 277 U.S. 438, 464 (1928) (in rejecting claim that Fourth Amendment prohibited listening to private telephone calls, stating that “There was no searching. There was no seizure. The evidence was secured by the use of the sense of hearing and that only. There was no entry of the houses or offices of the defendants.”). 38 389 U.S. 347 (1967). 39 Id. at 353 (“The government’s activities in electronically listening to and recording the petitioner’s words violated the privacy upon which he justifiably relied . . . .”). 40 138 S. Ct. 2206 (2018). 41 Id. at 2218–20. 42 Id. at 2217 (citing United States v. Miller, 425 U.S. 435, 443 (1976) and Smith v. Maryland, 442 U.S. 735, 741 (1979)). Congressional Research Service 5 Data Protection Law: An Overview must obtain a warrant supported by probable cause to obtain this information.43 The Fourth Amendment thus provides a limited bulwark against government intrusion into digital privacy. In addition to the protection provided by the Fourth Amendment, in the 1960s and 1970s, the Court concluded that the Fourteenth Amendment’s guarantee of “liberty”44 implied the existence of a more general right of privacy, protecting individuals from government intrusion even outside the “search and seizure” context.45 In the 1977 case Whalen v. Roe, the Supreme Court explained that this constitutional right of privacy “in fact involve[s] at least two different kinds of interests. One is the individual interest in avoiding disclosure of personal matters, and another is the interest in independence in making certain kinds of important decisions.”46 The second of these interests relates primarily to individual rights concerning the “intimacies of [persons’] physical relationship,”47 as well as the right to abortion,48 and has little connection to data protection. However, the first of the interests listed in Whalen could potentially relate to data protection. This interest, the right to avoid certain disclosures, has come to be known as the right to “informational privacy.”49 Despite its broad expression in Whalen, every Supreme Court case to consider the informational privacy right has rejected the constitutional claim and upheld the government program alleged to have infringed on the right.50 In Whalen itself, physicians and patients challenged a New York law that required the recording of the names and addresses of all persons who had obtained certain drugs for which there was both a lawful and unlawful market.51 Although the Court acknowledged that the statute “threaten[ed] to impair . . . [the plaintiffs’] interest in the nondisclosure of private information,” the Court observed that the disclosures were an “essential part of modern medical practice” and the New York law had protections in place against unwarranted disclosure that showed a “proper concern” for the protection of privacy.52 Together, the Court found these factors sufficient to uphold the law.53 In the wake of Whalen and Nixon v. Administrator of General Services54—a case decided the same year as Whalen that also 43 Id. at 2213–14. 44 U.S. CONST. amend. V (“No person shall . . . be deprived of life, liberty, or property, without due process of law.”); id. amend. XIV (“[N]or shall any State deprive any person of life, liberty, or property, without due process of law . . . .”). 45 See Whalen v. Roe, 429 U.S. 589, 599–600, 599 n.23 (1977); Griswold v. Connecticut, 381 U.S. 479, 485 (1965) (“The present case, then, concerns a relationship lying within the zone of privacy created by several fundamental constitutional guarantees.”). 46 Whalen, 429 U.S. at 600. 47 See Lawrence v. Texas, 539 U.S. 558, 577–78 (2003). See also Eisenstadt v. Baird, 405 U.S. 438, 453 (1972) (“If the right of privacy means anything, it is the right of the individual, married or single, to be free from unwarranted governmental intrusion into matters so fundamentally affecting a person as the decision whether to bear or beget a child.”); Griswold, 381 U.S. at 485. 48 See Roe v. Wade, 410 U.S. 113, 152–53 (1973) (“This right of privacy, whether it be founded in the Fourteenth Amendment’s concept of personal liberty and restrictions upon state action, as we feel it is, or, as the District Court determined, in the Ninth Amendment’s reservation of rights to the people, is broad enough to encompass a woman’s decision whether or not to terminate her pregnancy.”) (internal citations omitted). 49 NASA v. Nelson, 562 U.S. 134, 159 (2011). 50 DANIEL J. SOLOVE & PAUL M. SCHWARTZ, INFORMATION PRIVACY LAW 564 (6th ed. 2018) (“Subsequent to Whalen and Nixon the Court did little to develop the right of information privacy . . .”). 51 Whalen, 429 U.S. at 591. 52 Id. at 604–05. 53 Id. at 605. 54 433 U.S. 425, 458–60 (1977) (rejecting constitutional privacy claim against Presidential Recordings and Materials Preservation Act; observing that Act had regulations aimed at preventing “undue dissemination of private materials” Congressional Research Service 6 Data Protection Law: An Overview considered the right to informational privacy—courts have struggled to articulate the precise contours of the right. The most recent Supreme Court case to consider the right to informational privacy, NASA v. Nelson,55 went so far as to suggest that the right might not exist, “assuming without deciding” that the right existed in the course of rejecting the constitutional claim challenge to a government background check program for hiring.56 Despite the Supreme Court’s lack of clarity about the right to informational privacy, “most federal circuit courts” recognize the right to various extents.57 All of the constitutional rights involving privacy, like the common law privacy torts, focus on public disclosure of private facts. This focus limits their potential influence on modern data privacy debates, which extends beyond the disclosure issue to more broadly concern how data is collected, protected, and used.58 Perhaps more importantly, whatever the reach of the constitutional right to privacy, the “state action doctrine” prevents it from being influential outside the realm of government action. Under this doctrine, only government action is subject to scrutiny under the Constitution, but purely private conduct is not proscribed, “no matter how unfair that conduct may be.”59 As a result, neither the common nor constitutional law provides a complete framework for considering many of the potential threats to digital privacy and consumer data. Rather, the most important data protection standards come from statutory law. Federal Data Protection Law Given the inherent limitations in common law and constitutional protections, Congress has enacted a number of federal laws designed to provide statutory protections of individuals’ personal information. In contrast with the scheme prevalent in Europe and some other countries, rather than a single comprehensive law, the United States has a “patchwork” of federal laws that govern companies’ data protection practices.60 These laws vary considerably in their purpose and scope. Most impose data protection obligations on specific industry participants—such as financial institutions, health care entities, and and that any privacy intrusion must be weighed against “public interest”). 55 562 U.S. 134 (2011). 56 See NASA, 562 U.S. at 138 (“We assume, without deciding, that the Constitution protects a privacy right of the sort mentioned in Whalen and Nixon. We hold, however, that the challenged portions of the Government’s background check do not violate this right in the present case.”). Justices Scalia and Thomas concurred in the judgment, expressing their view that “[a] federal constitutional right to ‘informational privacy’ does not exist.” Id. at 159–60 (Scalia, J., concurring). 57 See SOLOVE & SCHWARTZ, supra note 50, at 564 (citing cases). See also Hancock v. Cty. of Renssalaer, 882 F.3d 58, 65–68 (2d Cir. 2018) (articulating the test for balancing the interests in the disclosure of medical records to the government, concluding that general issues of material fact precluded summary judgment on claim that county jail had violated employees’ Fourteenth Amendment rights); Big Ridge, Inc. v. Fed. Mine Safety and Health Review Comm’n, 715 F.3d 631, 649 (7th Cir. 2013) (“Whether the government can require banks, medical providers, or employers to turn over private medical records of customers, patients, or employees that are in their possession is a difficult question of balancing.”). 58 See supra notes 3, 10, 18–20 and accompanying text. See also infra § Considerations for Congress. 59 National Collegiate Athletic Ass’n v. Tarkanian, 488 U.S. 179, 191 (1988). 60 Heck, supra note 15, at 59; see also Daniel Solove & Woodrow Hartzog, The FTC and the New Common Law of Privacy, 114 Colum. L. Rev. 583, 587 (2014) (“The statutory law is diffuse and discordant . . . . Unlike the privacy laws of many industrialized nations, which protect all personal data in an omnibus fashion, privacy law in the United States is sectoral, with different laws regulating different industries and economic sectors. . . . This sectoral approach also leaves large areas unregulated . . . .”). Congressional Research Service 7 Data Protection Law: An Overview communications common carriers—or specific types of data, such as children’s data.61 Other laws, however, supplement the Constitution’s limited privacy protections and apply similar principles to private entities. The Stored Communications Act (SCA), for instance, generally prohibits the unauthorized access or disclosure of certain electronic communications stored by internet service providers.62 Lastly, some laws prohibit broad categories of conduct that, while not confined to data protection, limit how companies may handle personal data. Most notably, the Federal Trade Commission Act (FTC Act) prohibits “unfair or deceptive acts or practices.”63 As some scholars have pointed out, the FTC has used its authority under the FTC Act to develop norms and principles that effectively fill in the gaps left by other privacy statutes.64 These laws are organized below, beginning with those most narrowly focused on discrete industries and moving toward more generally applicable laws. In light of its gap-filling function, this section lastly discusses the FTC Act—along with the Consumer Financial Protection Act (CFPA), which covers similar types of conduct.65 The Appendix to this report contains a table summarizing the federal data protection laws discussed.66 Gramm-Leach-Bliley Act (GLBA) The Gramm-Leach-Bliley Act (GLBA)67 imposes several data protection obligations on financial institutions.68 These obligations are centered on a category of data called “consumer”69 “nonpublic personal information”70 (NPI), and generally relate to: (1) sharing NPI with third 61 See infra §§ Gramm-Leach-Bliley Act (GLBA), Health Insurance Portability and Accountability Act (HIPAA), The Communications Act, and Children’s Online Privacy Protection Act (COPPA). 62 Orin S. Kerr, A User’s Guide to the Stored Communications Act, and a Legislator’s Guide to Amending It, 72 GEO. WASH. L. REV. 1208, 1212 (2004) (“The [SCA] creates a set of Fourth Amendment-like privacy protections by statute, regulating the relationship between government investigators and service providers in possession of users’ private information.”). 63 15 U.S.C. § 45(a). 64 Solove & Hartzog, supra note 60, at 587–88 (“It is fair to say that today FTC privacy jurisprudence is the broadest and most influential regulating force on information privacy in the United States . . . . Because so many companies fall outside of specific sectoral privacy laws, the FTC is in many cases the primary source of regulation.”); Anna Karapetyan, Developing a Balanced Privacy Framework, 27 S. CAL REV. L. & SOC. JUST. 197, 213 (“The Federal Trade Commission (‘FTC’) . . . steps in to fill gaps in statutory protections. The FTC uses its broad authority to restrict ‘unfair or deceptive acts or practices’ to protect consumer privacy. Unlike federal statutory laws, the FTC is not limited to specific sectors of the economy and its authority applies to most companies acting in commerce.”). 65 This section focuses on federal laws applicable to companies that collect and maintain personal information. It does not cover federal laws primarily applicable to government agencies or government employees, such as the Privacy Act (5 U.S.C. § 552a) or the E-Government Act (44 U.S.C. § 3501 note). 66 See infra § Summary of Federal Data Protection Laws. 67 15 U.S.C. §§ 6801–6809. 68 Under GLBA, a “financial institution” is defined as “any institution the business of which is engaging in financial activities” as described in section 49(k) of the Bank Holding Company Act (12 U.S.C. § 1843(k)). 15 U.S.C. § 6809(3). This definition encompasses a broad range of entities, such as “banks; real estate appraisers and title companies; companies that provide consumer financing, insurance underwriters and agents; wire transfer, check cashing, and check printing companies; mortgage brokers; and travel agents that operate in connection with financial services.” SARAH J. AUCHTERLONIE & ALEXANDRA E. SICKLER, CONSUMER FINANCE LAW AND COMPLIANCE 13–45 (2017). 69 GBLA defines “consumer” as an “individual who obtains, from a financial institution, financial products or services which are to be used primarily for personal, family, or household purposes” or “the legal representative of such an individual.” 15 U.S.C. § 6809(9). 70 GBLA defines “nonpublic personal information” as “personally identifiable financial information” that is not “publicly available” and is either is “provided by a consumer to a financial institution,” “resulting from any transaction with the consumer or any service performed for the consumer,” or “otherwise obtained by the financial institution.” Id. Congressional Research Service 8 Data Protection Law: An Overview parties, (2) providing privacy notices to consumers, and (3) securing NPI from unauthorized access. First, unless an exception applies, GLBA and its implementing regulations prohibit financial institutions from sharing NPI with non-affiliated third parties unless they first provide the consumers with notice and an opportunity to “opt-out.”71 Furthermore, financial institutions are prohibited altogether from sharing account numbers or credit card numbers to third parties for use in direct marketing.72 Second, financial institutions must provide “clear and conspicuous” initial and annual notices to customers describing their privacy “policies and practices.”73 These notices must include, among other things, the categories of NPI collected and disclosed, the categories of third parties with which the financial institution shares NPI, and policies and practices with respect to protecting the confidentiality and security of NPI.74 Third, GLBA and its implementing regulations (often referred to as the “Safeguards Rule”75) require financial institutions to maintain “administrative, technical, and physical safeguards” to “insure the security and confidentiality” of “customer”76 (as opposed to “consumer”) NPI, and to protect against “any anticipated threats or hazards” or “unauthorized access” to such information.77 Financial institutions regulated by federal banking agencies78 are further required to implement a program for responding to the unauthorized access of customer NPI.79 The Consumer Financial Protection Bureau (CFPB), FTC, and federal banking agencies share civil enforcement authority for GLBA’s privacy provisions.80 However, the CFPB has no § 6809(4). 71 Id. § 6802; 12 C.F.R. § 1016.10(a). The opt-out notice must be “clear and conspicuous” and must provide a “reasonable means” to exercise the opt-out right, such as through “designate[d] check boxes” or providing a “toll-free telephone number” that consumers may call. 12 C.F.R. § 1016.7(a). The opt-out notice can be given in the same electronic or written form as the initial notice of the company’s privacy policy. Id. § 1016.7(b). Exceptions to the optout requirement include situations where a financial institution shares NPI with a third party performing services on behalf of the financial institution, such as the marketing of the financial institution’s own products, provided that the third party is contractually obligated to maintain the confidentiality of the information. 15 U.S.C. § 6802(b)(2); 12 C.F.R. § 1016.13. Exceptions further include situations where a financial institution shares NPI with third parties to “effect, administer, or enforce a transaction” requested by the consumer. 15 U.S.C. § 6802(e); 12 C.F.R. § 1016.14. 72 Specifically, financial institutions are prohibited from disclosing such information to third parties, other than a consumer reporting agency, “for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer.” 15 U.S.C. § 6802(d); 16 C.F.R. § 313.12(a). 73 15 U.S.C. § 6803(a); 12 C.F.R. §§ 1016.4–1016.6. 74 12 C.F.R. § 1016.6(a). 75 See, e.g., Financial Institutions and Customer Information: Complying with the Safeguards Rule, FED. TRADE COMM’N (Apr. 2006), https://www.ftc.gov/tips-advice/business-center/guidance/financial-institutions-customerinformation-complying. 76 Unlike the disclosure requirements, the safeguard requirements only apply to customers’ NPI, rather than consumers’ NPI. 15 U.S.C. § 6801(b); 16 C.F.R. § 314.3. A customer is defined as someone who has a “continuing relationship” with the financial institution, such as someone who has obtained a loan or who has opened a credit or investment account. 16 C.F.R. § 313.3(h)–(i); see also 12 C.F.R. § 1016.3(i)–(j). 77 15 U.S.C. § 6801(a); 16 C.F.R. § 314.3. Such safeguards must include, among other things, the designation of an information security program coordinator, a risk assessment process, and the implementation and testing of information safeguards designed to control risks identified through the risk assessment process. 16 C.F.R. § 314.4. 78 Federal banking agencies include the Comptroller of the Currency, the Board of Governors of the Federal Reserve System, and the Federal Deposit Insurance Corporation. 12 U.S.C. § 1813. 79 70 Fed. Reg. 15736 (2005). 80 15 U.S.C. § 6805(a). The CFPB has exclusive enforcement authority over depository institutions (such as banks, thrifts, and credit unions) with over $10 billion in total assets, and federal banking agencies have exclusive enforcement authority over depository institutions and credit unions with $10 billion or less in total assets. Id. § 6805(a). The CFPB Congressional Research Service 9 Data Protection Law: An Overview enforcement authority over GLBA’s data security provisions.81 Under the data security provisions, federal banking regulators have exclusive enforcement authority for depository institutions, and the FTC has exclusive enforcement authority for all non-depository institutions.82 GLBA does not specify any civil remedies for violations of the Act, but agencies can seek remedies based on the authorities provided in their enabling statutes, as discussed below.83 GLBA also imposes criminal liability on those who “knowingly and intentionally” obtain or disclose “customer information” through false or fraudulent statements or representations.84 Criminal liability can result in fines and up to five years’ imprisonment.85 GLBA does not contain a private right of action that would allow affected individuals to sue violators.86 Health Insurance Portability and Accountability Act (HIPAA) Under the Health Insurance Portability and Accountability Act (HIPAA), the Department of Health and Human Services (HHS) has enacted regulations protecting a category of medical information called “protected health information” (PHI).87 These regulations apply to health care providers, health plans, and health care clearinghouses (covered entities), as well as certain “business associates”88 of such entities.89 The HIPAA regulations generally speak to covered and FTC share enforcement authority over the remaining non-depository financial institutions the GLBA covers. Id. 81 Id. § 6805(a)(8) (excluding the CFPB from jurisdiction over the data security provisions). 82 Id. § 6805(a)(1)–(7). 83 See, e.g., JOSEPH BECKMAN, LAW AND BUSINESS OF COMPUTER SOFTWARE § 13:3 (2018) (“The agency enforcing the GLBA will then typically proceed under its own grant of authority and general ability to impose fines.”). For instance, under the CFPA, the CFPB can seek a broad range of remedies, including equitable relief and penalties, and under the FTC Act the FTC can seek equitable relief. See infra §§ Consumer Financial Protection Act (CFPA) and Federal Trade Commission Act (FTC Act). 84 15 U.S.C. §§ 6821, 6823. 85 Id. § 6823. 86 See, e.g., Barroga-Hayes v. Settenbrino, P.C., No. 10-CV-5298, 2012 WL 1118194, at *6 n. 5 (E.D.N.Y. Mar. 30, 2012) (noting that “there is no private right of action under the GLBA”). 87 45 C.F.R. part 164. HIPAA regulations define “protected health information” as “individually identifiable health information” transmitted or maintained in “electronic media” or “any other form or medium.” Id. § 160.103. In turn, “individually identifiable health information” is defined as health information that: (1) “identifies” or can reasonably “be used to identify” an individual; (2) is “created or received by a health care provider, health plan, employer, or health care clearinghouse”; and (3) relates to an individual’s physical or mental health, health care provision, or payment for provision of health care. Id. “Individually identifiable heath information” does not include data meeting certain “de-identification” requirements. Id. § 164.514. Under these requirements, information will not be considered individually identifiable if either: (1) an expert determines that “the risk is very small that the information could be used” to “identify an individual who is a subject of the information” and the expert “[d]ocuments the methods and results of the analysis that justify such determination”; or (2) the information excludes 18 listed identifiers—such as the individual’s name, address information, Social Security number, and contact information—and the covered entity does not have “actual knowledge” that the information could be used to identify the individual. Id. 88 A “business associate” is defined as “with respect to a covered entity, a person who: (i) [o]n behalf of such covered entity . . . , but other than in the capacity of a member of the workforce of such covered entity or arrangement, creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter . . . ; or (ii) [p]rovides, other than in the capacity of a member of the workforce of such covered entity, legal, actuarial, accounting, consulting, data aggregation . . . , management, administrative, accreditation, or financial services to or for such covered entity, or to or for an organized health care arrangement in which the covered entity participates, where the provision of the service involves the disclosure of protected health information from such covered entity or arrangement, or from another business associate of such covered entity or arrangement, to the person.” Id. § 160.103. 89 Id. §§ 164.104, 164.306, 164.502. Congressional Research Service 10 Data Protection Law: An Overview entities’: (1) use or sharing of PHI, (2) disclosure of information to consumers, (3) safeguards for securing PHI, and (4) notification of consumers following a breach of PHI. First, with respect to sharing, HIPAA’s privacy regulations generally prohibit covered entities from using PHI or sharing it with third parties without patient consent,90 unless such information is being used or shared for treatment, payment, or “health care operations”91 purposes, or unless another exception applies.92 Covered entities generally may not make treatment or services conditional on an individual providing consent.93 Second, with respect to consumer disclosures, covered entities must provide individuals with “adequate notice of the uses and disclosures of [PHI] that may be made by the covered entity, and of the individual’s rights and the covered entity’s legal duties with respect to [PHI].”94 These notices must be provided upon consumer request, and covered entities maintaining websites discussing their services or benefits must “prominently post” the notices on their websites.95 Furthermore, an individual has the right to request that a covered entity provide him with a copy of his PHI that is maintained by the covered entity.96 In some cases, an individual may also request that the covered entity provide information regarding specific disclosures of the individual’s PHI, including the dates, recipients, and purposes of the disclosures.97 Third, with respect to data security, covered entities must maintain safeguards to prevent threats or hazards to the security of electronic PHI.98 Lastly, HIPAA regulations contain a data breach notification requirement, requiring covered entities to, among other things, notify the affected individuals within 60 calendar days after discovering a breach of “unsecured”99 PHI.100 90 Valid consent must be accompanied by, among other things, a description of the information to be used or disclosed, and a description of the purpose of the requested use or disclosure, and the individual’s signature. Id. § 164.508(c). 91 “Health care operations” are defined as including a number of activities, such as: (1) “[c]onducting quality assessment and improvement activities,” (2) evaluating health care professionals and health plan performance, (3) underwriting and “other activities related to the creation, renewal, or replacement” of health insurance or health benefits contracts; (4) “conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs”; (5) business planning and development such as “conducting costmanagement and planning-related analyses related to managing and operating the entity,” and (6) “business management and general administrative activities of the entity.” Id. § 164.501. 92 Id. §§ 164.506–508. Exceptions to the consent requirement include, among other things, when the use or disclosure is required by law, for public health activities, or for law enforcement purposes. Id. § 164.512. 93 Id. § 164.508 (b)(4). Several exceptions apply to this rule, such as when the treatment is research-related or when “the authorization sought is for the health plan’s eligibility or enrollment determinations relating to the individual or for its underwriting or risk rating determinations.” Id. 94 Id. § 164.520(a). 95 Id. § 164.520(c). The regulations further contain specific requirements for certain categories of covered entities; in particular, health plans must provide notices at the time an individual enrolls in the plan and at least once every three years thereafter. Id. § 164.520(c)(1). Health care providers must provide the notice by the “date of the first service delivery,” or, for emergency treatment situations, “as reasonably practicable” after the treatment; they must further make a “good faith effort” to obtain a written acknowledgement of receipt (except for emergency treatment situations), and they must post the notice in a “clear and prominent location” at any physical service delivery site and have the notices available for individuals to take with them upon request. Id. § 164.520(c)(2). 96 Id. § 164.524(a). There are several exceptions to this right; in particular, individuals do not have a right to access: (1) psychotherapy notices or (2) information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative proceeding. Id. § 164.524(a)(1). 97 Id. §164.528. 98 Id. §§ 164.302–318. 99 “Unsecured” PHI is defined as PHI that “is not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary . . . .” Id. § 164.402. 100 Id. §§ 164.400–414. HIPAA regulations define a “breach” as the “acquisition, access, use, or disclosure of protected Congressional Research Service 11 Data Protection Law: An Overview Violations of HIPAA’s privacy requirements can result in criminal or civil enforcement. HHS possesses civil enforcement authority and may impose civil penalties, with the amount varying based on the level of culpability.101 The Department of Justice has criminal enforcement authority and may seek fines or imprisonment against a person who, in violation of HIPAA’s privacy requirements, “knowingly” obtains or discloses “individually identifiable health information” or “uses or causes to be used a unique health identifier.”102 HIPAA does not, however, contain a private right of action that would allow aggrieved individuals to sue alleged violators.103 Fair Credit Reporting Act (FCRA) The Fair Credit Reporting Act (FCRA)104 covers the collection and use of information bearing on a consumer’s creditworthiness. FCRA and its implementing regulations govern the activities of three categories of entities: (1) credit reporting agencies (CRAs),105 (2) entities furnishing information to CRAs (furnishers),106 and (3) individuals who use credit reports issued by CRAs (users).107 In contrast to HIPAA or GLBA, there are no privacy provisions in FCRA requiring entities to provide notice to a consumer or to obtain his opt-in or opt-out consent before collecting or disclosing the consumer’s data to third parties. FCRA further has no data security provisions requiring entities to maintain safeguards to protect consumer information from unauthorized access. Rather, FCRA’s requirements generally focus on ensuring that the consumer information reported by CRAs and furnishers is accurate and that it is used only for certain permissible purposes.108 health information in a manner not permitted under [HIPAA’s privacy regulations] which compromises the security or privacy of the protected health information.” Id. § 164.402. This definition contains several exclusions, including where the covered entity has a “good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.” Id 101 42 U.S.C. § 1320d-5; 45 C.F.R. § 160.404. The amounts range from $100 per violation (with a total maximum of $25,000 per year for identical violations) up to $50,000 per violation (with a total maximum of $1,500,000 per year for identical violations). 45 C.F.R. § 160.404(b). The low-end of the penalty spectrum applies when the offender “did not know and, by exercising reasonable diligence, would not have known” of the violation, and the high-end of the penalty spectrum applies when “it is established that the violation was due to willful neglect and was not corrected during the 30-day period beginning on the first date the covered entity or business associate liable for the penalty knew, or by exercising reasonable diligence, would have known that the violation occurred.” Id. 102 42 U.S.C. § 1320d-6. See also Office of Civil Rights, Enforcement Process, HEALTH & HUMAN SERVICES (June 7, 2017), https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/enforcement-process/index.html (“OCR also works in conjunction with the Department of Justice (DOJ) to refer possible criminal violations of HIPAA.”). Ordinary criminal violations can result in up to $50,000 in fines and up to one year imprisonment. 42 U.S.C. § 1320d6(b)(1). However, if the offense is committed under false pretenses, then liability can result in up to $100,000 in fines and up to five years imprisonment. Id. § 1320d-6(b)(2). If the offense is committed with an intent to “sell, transfer, or use” individually identifiable health information for commercial advantage, personal gain, or malicious harm, then liability can result in up to $250,000 in fines and up to ten years imprisonment. Id. § 1320d-6(b)(3). 103 See, e.g., Univ. of Colo. Hosp. v. Denver Pub. Co., 340 F. Supp. 2d 1142, 1143 (D. Colo. 2004) (holding that no private right of action exists under HIPAA). 104 15 U.S.C. §§ 1681–1681x. 105 A CRA is any entity that, for a fee or on a cooperative nonprofit basis, regularly assembles or evaluates “consumer credit information” or “other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.” Id. § 1681a(f). 106 FCRA regulations define a “furnisher” as any entity that provides a CRA with information “relating to consumers” for inclusion in a consumer report. 12 C.F.R. § 1022.41(c). 107 AUCHTERLONIE & SICKLER, supra note 68, at 13-39. 108 See, e.g., CHI CHI WU, FAIR CREDIT REPORTING § 1.3.1 (2013) (“The FCRA attempts to protect consumers’ privacy Congressional Research Service 12 Data Protection Law: An Overview With respect to accuracy, CRAs must maintain reasonable procedures to ensure the accuracy of information used in “consumer reports.”109 CRAs must further exclude adverse information, such as “accounts placed in collection” or civil judgements, from consumer reports after a certain amount of time has elapsed.110 Furnishers must similarly establish reasonable policies and procedures to ensure the accuracy of the information reported to CRAs and may not furnish to a CRA any consumer information if they have reasonable cause to believe that information is inaccurate.111 Consumers also have the right to review the information CRAs have collected on them to ensure such information is accurate. CRAs must disclose information contained in a consumer’s file upon the consumer’s request, as well as the sources of the information and the identity of those who have recently procured consumer reports on the consumer.112 Should a consumer dispute the accuracy of any information in his file, CRAs and furnishers must reinvestigate the accuracy of the contested information.113 In addition to the accuracy requirements, under FCRA consumer reports may be used only for certain permissible purposes such as credit transactions.114 Accordingly, a CRA may generally furnish consumer reports to a user only if it “has a reason to believe” the user intends to use it for a permissible purpose.115 Likewise, users may “use or obtain a consumer report” only for a permissible purpose.116 Along with the permissible purpose requirement, users must further notify consumers of any “adverse action” taken against the consumer based on the report.117 Adverse actions include refusing to grant credit on substantially the terms requested, reducing insurance coverage, and denying employment.118 and reputations by placing various obligations on persons who use or disseminate credit information about consumers. Consumer reporting agencies must adopt reasonable procedures to ensure that the information they disseminate is accurate and up-to-date and that it is furnished only to users with certain permissible purposes.”). 109 15 U.S.C. § 1681e(b). “Consumer reports” are defined as communications by a CRA about a consumer, which are “used or expected to be used” to evaluate the consumer for credit, insurance, employment or another permissible purpose under the Act. Id. § 1681a(d). 110 Id. § 1681c(a). Generally, adverse information may not be reported once the information “antedates the report by more than seven years.” Id. There are certain exceptions, however, to this general rule. For instance, bankruptcy cases may be reported for up to ten years. Id. § 1681c(a)(1). 111 Id. § 1681s-2(a)(1)(A); 12 C.F.R. § 1022.42. 112 15 U.S.C. § 1681g(a). If the report was procured for employment purposes, then CRAs must identify each procuring individual in the past two years. Id. § 1681g(a)(3)(A)(i). For any other purpose, CRAs need only identify any individual who has procured a consumer report in the past year. Id. § 1681g(a)(3)(A)(ii). 113 15 U.S.C. §§ 1681i(a), 1681s-2(b); 12 C.F.R. § 1022.43. 114 Other permissible purposes include, among other things, using the information for (1) employment purposes, (2) insurance underwriting involving the consumer, (3) evaluating a consumer’s eligibility for a “license or benefit granted by a governmental instrumentality required by law to consider an applicant’s financial responsibility or status,” or (4) a “legitimate business need” in connection with a business transaction initiated by the consumer or the review of an account to determine whether the consumer continues to meet the terms of the account. 15 U.S.C. § 1681b(a). 115 Id. at § 1681b(a)(3). 116 Id. § 1681m(f). 117 Id. § 1681m(a). 118 Id. §§ 1681a(k)(1), 1691(d)(6). Congressional Research Service 13 Data Protection Law: An Overview The FTC and the CFPB share civil enforcement authority over FCRA,119 with each agency possessing enforcement authority over entities subject to their respective jurisdictions.120 In addition to government enforcement, FCRA provides a private right of action for consumers injured by willful or negligent violations of the Act.121 Consumers bringing such actions for negligent violations of the Act may recover actual damages, attorney’s fees, and other litigation costs.122 For willful violations, consumers may recover either actual damages or statutory damages ranging from $100 to $1,000, attorney’s fees, other litigation costs, and “such amount of punitive damages as the court may allow.”123 FCRA also imposes criminal liability on any individual who knowingly and willfully obtains consumer information from a CRA under false pretenses and on any officer or employee of a CRA who knowingly and willfully provides consumer information to a person not authorized to receive that information.124 The Communications Act The Communications Act of 1934 (Communications Act or Act), as amended,125 established the Federal Communications Commission (FCC) and provides a “comprehensive scheme” for the regulation of interstate communication.126 Most relevant to this report, the Communications Act includes data protection provisions applicable to common carriers, cable operators, and satellite carriers. Common Carriers The Telecommunications Act of 1996127 amended the Communications Act to impose data privacy and data security requirements on entities acting as common carriers.128 Generally, common carrier activities include telephone and telegraph services but exclude radio broadcasting, television broadcasting, provision of cable television, and provision of broadband 119 Id. § 1681s; see also ROBERT BROWNSTONE & TYLER NEWBY, FAIR CREDIT REPORTING ACT GENERALLY, DATA SECURITY & PRIVACY LAW § 9:139 (2018) (“[T]he Consumer Financial Protection Bureau (CFPB) assumed concurrent jurisdiction, and now rulemaking and enforcement duties for the FCRA are shared by the CFPB and the FTC.”). Because the two agencies’ jurisdiction overlaps, the FTC and CFPB have executed a Memorandum of Understanding (MOU) in which they agreed to coordinate enforcement activities. See Memorandum of Understanding Between the Consumer Financial Protection Bureau and the Federal Trade Commission (2012), https://www.ftc.gov/system/files/ 120123ftc-cfpb-mou.pdf. 120 15 U.S.C. §§ 1681s(a), (b)(H). 121 Id. §§ 1681n–1681o. But see infra § Private Rights of Action and Standing (discussing limitations on this private right of action). 122 15 U.S.C. § 1681o(a). 123 Id. § 1681n(a). 124 Id. §§ 1681q–1681r. Criminal liability can result in fines and up to two years imprisonment. Id. 125 47 U.S.C. ch. 5. 126 Benanti v. United States, 355 U.S. 96, 104 (1957). 127 Pub. L. No. 104-104, 110 Stat. 56 (1996) (codified throughout 47 U.S.C.). 128 Specifically, the act uses the term “telecommunications carrier,” which the FCC has interpreted as synonymous with a “common carrier.” In the Matter of AT&T Submarine Systems, Inc., 13 FCC Rcd. 21585, 21587–21588 (F.T.C. 1998) (“As the Commission has previously held, the term ‘telecommunications carrier’ means essentially the same as common carrier.”). The term “telecommunications carrier” is defined as “any provider of telecommunications services.” 47 U.S.C. § 153(51). “Telecommunication service” is further defined as “the offering of telecommunications for a fee directly to the public, or to such classes of users as to be effectively available directly to the public, regardless of the facilities used.” Id. § 153(53). Congressional Research Service 14 Data Protection Law: An Overview internet.129 The privacy and security requirements imposed on entities acting as common carriers130 are primarily centered on a category of information referred to as “customer proprietary network information (CPNI).”131 CPNI is defined as information relating to the “quantity, technical configuration, type, destination, location, and amount of use of a telecommunications service subscribed to by any customer of a telecommunications carrier,” and is “made available to the carrier by the customer solely by virtue of the carrier-customer relationship.”132 Section 222(c) of the Communications Act and the FCC’s implementing regulations set forth carriers’ obligations regarding CPNI. These provisions cover three main issues. First, carriers must comply with certain use and disclosure rules. Section 222(c) imposes a general rule that carriers may not “use, disclose, or permit access to” “individually identifiable”133 CPNI without customer approval,134 unless a particular exception applies.135 Before a carrier may solicit a customer for approval to use or disclose their CPNI, it must notify customers of their legal rights regarding CPNI and provide information regarding the carrier’s use and disclosure of CPNI.136 Second, carriers must implement certain safeguards to ensure the proper use and disclosure of CPNI.137 These safeguards must include, among other things, a system by which the “status of a customer’s CPNI approval can be clearly established” prior to its use, employee training on the authorized use of CPNI, and “reasonable measures” to discover and protect against attempts to 129 See, e.g., id. § 153(11) (“a person engaged in radio broadcasting shall not . . . be deemed a common carrier”); United States v. Radio Corp. of Am., 358 U.S. 334, 349 (1959) (“In contradistinction to communication by telephone and telegraph, which the Communications Act recognizes as a common carrier activity . . . the Act recognizes that broadcasters are not common carriers and are not to be dealt with as such.”) (internal quotations omitted); FCC v. Midwest Video Corp., 440 U.S. 689, 708–9 (1979) (“The Commission may not regulate cable systems as common carriers, just as it may not impose such obligations on television broadcasters.”); FCC Order, Restoring Internet Freedom, FCC 17-166 (Jan. 4, 2018) (reversing a 2015 order classifying broadband internet access service as a common-carriage service and instead classifying it as an “information service”). 130 As a recent decision by the U.S. Court of Appeals for the Ninth Circuit clarified, common carrier classification is activity-based rather than status-based. FTC v. AT&T Mobility LLC, 883 F.3d 848, 850 (9th Cir. 2018) (“[W]e conclude that the [common carrier exemption under the FTC Act] is activity-based. The phrase ‘common carriers subject to the Acts to regulate commerce’ thus provides immunity from FTC regulation only to the extent that a common carrier is engaging in common-carrier services.”); see also Nat’l Ass’n of Regulatory Util. Comm’rs v. FCC, 533 F.2d 601, 608 (D.C. Cir. 1976) (“[O]ne can be a common carrier with regard to some activities but not to others.”). 131 47 U.S.C. § 222(h)(1). 132 Id. § 222(h)(1). The Act further states that CPNI includes “information contained in the bills pertaining to telephone exchange service or telephone service received by a customer of a carrier” but does not include “subscriber list information.” Id. 133 “Individually identifiable” is not defined in the statute or regulations. See id. §§ 153, 222(h); 47 C.F.R. § 64.2003. 134 The regulations provide that, generally, customer approval must be “opt-in” approval. 47 C.F.R. §§ 64.2007(b). “Opt-in approval” requires that “the carrier obtain from the customer “affirmative, express consent allowing the requested CPNI usage, disclosure, or access . . . .” Id. § 64.2003(k). However, carriers only need to obtain “opt-out approval” to use or disclose individually identifiable CPNI to its agents and affiliates for marketing communicationsrelated service. Id. § 64.2007(b). Under “opt-out approval,” a customer is deemed to have consented if he has “failed to object” within a specified waiting period after being provided the “appropriate notification of the carrier’s request for consent.” Id. § 64.2003(l). 135 47 U.S.C. § 222(c); 47 C.F.R. § 64.2007. Exceptions include, among other things, using or disclosing individually identifiable CPNI to disclose “aggregate customer information,” provide or market service offerings for services to which the customer already subscribes, or provide “inside wiring installation, maintenance, and repair services.” 47 U.S.C. §§ 222(c)–(d); 47 C.F.R. § 64.2005. 136 47 C.F.R. § 64.2008. 137 Id. §§ 64.2009–64.2010. Congressional Research Service 15 Data Protection Law: An Overview gain unauthorized access to CPNI.”138 Lastly, carriers must comply with data breach requirements. Following a “breach”139 of customers’ CPNI, a carrier must disclose such a breach to law enforcement authorities no later than seven days following a “reasonable determination of the breach.”140 After it has “completed the process of notifying law enforcement,” it must notify customers whose CPNI has been breached.141 In addition to the CPNI requirements, the Communications Act contains three other potentially relevant data privacy and security provisions pertaining to common carriers. First, Section 222(a) of the Act states that carriers must “protect the confidentiality of proprietary information” of “customers.”142 Second, Section 201(b) of the Act declares unlawful “any charge, practice, classification, and regulation” in connection with a carrier’s communication service that is “unjust or unreasonable.”143 Lastly, Section 202(a) provides that it shall “be unlawful for any common carrier to make any unjust or unreasonable discrimination in charges, practices, classification, regulations, facilities, or services . . . .”144 In a 2016 rule,145 which was subsequently overturned pursuant to the Congressional Review Act,146 the FCC attempted to rely on these three provisions to regulate a broad category of data called “customer proprietary information” (customer PI).147 While customer PI is not defined in the statute, the FCC’s 2016 rule defined it broadly to include CPNI, as well as other “personally identifiable information” and the “content of communications.” The FCC reasoned that Section 222(a) imposes a general duty, independent from Section 222(c), on carriers to protect the confidentiality of customer PI.148 It further maintained that Sections 201(b) and 202(a) provide independent “backstop authority” to ensure that no gaps are formed in commercial data privacy and security practices, similar to the FTC’s authority under the FTC Act.149 However, given that Congress overturned the 2016 rule, the FCC may be prohibited under the CRA from relying on these three provisions to regulate data privacy and security. Under the CRA, the FCC may not reissue the rule in “substantially the same form” or issue a “new rule that is substantially the 138 Id. 139 The regulations provide that a “breach” occurs “when a person, without authorization or exceeding authorization, has intentionally gained access to, used, or disclosed CPNI.” Id. § 64.2011(e). 140 Id. § 64.2011(b). 141 Id. § 64.2011(c). The regulations do not specify a timeline for notifying customers of a breach following the notification of law enforcement. See id. 142 47 U.S.C. § 222(a). 143 Id. § 201(b). 144 Id. § 202(a). 145 Protecting the Privacy of Customers of Broadband and Other Telecommunications Services, 81 Fed. Reg. 87274 (Dec. 2, 2016). 146 S.J. Res. 34, 115th Cong. (2017) (enacted). Senator Jeff Flake, who introduced the joint resolution, criticized the FCC’s rule as “restricting the free speech of its regulatory target” and creating a “dual track regulatory environment where some consumer data is regulated one way if a company is using it under the FCC’s jurisdiction and an entirely different way if its use falls under the FTC . . . .” 163 Cong Rec. S. 1,925 (2017). He further stated that overturning the rules would “restor[e] a single, uniform set of privacy rules for the internet” and “send a powerful message that Federal agencies can’t unilaterally restrict constitutional rights and expect to get away with it.” Id. 147 The FCC rule defined “customer proprietary information” to include “individually identifiable CPNI,” “personally identifiable information,” and “content of communications.” 81 Fed. Reg. 87274, 87275. 148 Id. at 87323–87327. 149 Id. at 87328. See § Federal Trade Commission Act (FTC Act), infra, for more information on the FTC’s authority. Congressional Research Service 16 Data Protection Law: An Overview same” as the overturned rule “unless the reissued or new rule is specifically authorized by a law enacted after the date of the joint resolution disapproving the original rule.”150 The FCC is empowered to enforce civil violations of the Communications Act’s provisions, including its common carrier provisions.151 The FCC may impose a “forfeiture penalty” against any person who “willfully or repeatedly” violates the Act or the FCC’s implementing regulations.152 The Communications Act further imposes criminal penalties on those who “willfully and knowingly” violate the statute or the FCC’s implementing regulations.153 Along with its general civil and criminal provisions, the Communications Act provides a private right of action for those aggrieved by violations of its common carrier provisions; in such actions, plaintiffs may seek actual damages and reasonable attorney’s fees.154 Cable Operators and Satellite Carriers In addition to common carriers, the Communications Act imposes a number of data privacy and security requirements on how “cable operators”155 and “satellite carriers”156 (i.e., covered entities) 150 5 U.S.C. § 801(b)(2). The CRA does not define “substantially the same.” See id. § 804. Further, the CRA may preclude courts from determining whether a rule is “substantially the same,” as it states that “no determination, finding, action, or omission under this chapter shall be subject to judicial review.” Id. § 805. Some courts have suggested this provision prevents them from reviewing all actions alleging noncompliance with the CRA. See, e.g., Montanans for Multiple Use v. Barbouletos, 568 F.3d 225, 229 (D.C. Cir. 2009) (“The [CRA] provision denies courts the power to void rules on the basis of agency noncompliance with the Act. The language of § 805 is unequivocal and precludes review of this claim—even assuming that the plan amendments qualify as rules subject to the Act in the first place.”); but see Ctr. for Biological Diversity v. Zinke, 313 F. Supp. 3d 976, 991 n.89 (D. Alaska 2018) (“CBD is not seeking review of action taken under the CRA. Instead, CBD is claiming that DOI, at the behest of Congress, acted ultra vires in taking action beyond the authority provided by the CRA. Therefore, § 805‘s restriction on judicial review does not apply.”). For more information on the CRA, see CRS Report R45248, The Congressional Review Act: Determining Which “Rules” Must Be Submitted to Congress, by Valerie C. Brannon and Maeve P. Carey, and CRS Insight IN10660, What Is the Effect of Enacting a Congressional Review Act Resolution of Disapproval?, by Maeve P. Carey. 151 47 U.S.C. §§ 151, 503(b). In recent years the FCC has brought several data privacy enforcement actions against common carriers. For instance, in 2015, in what the FCC called its “largest data security enforcement action,” AT&T settled allegations that it violated the Communications Act’s common carrier privacy provisions. Press Release, Fed. Commc’ns Comm’n, AT&T to Pay $25 Million to Settle Consumer Privacy Investigation (Apr. 8, 2015), https://docs.fcc.gov/public/attachments/DOC-332911A1.pdf. In that case, the FCC alleged that employees at AT&T call centers in Mexico, Colombia, and the Philippines accessed customer CPNI without authorization and also disclosed other non-CPNI sensitive customer information, such as names and full or partial Social Security numbers. AT&T Services, Inc., 30 FCC Rcd. 2808 (Apr. 8, 2015) (order and consent decree). 152 47 U.S.C. § 503(b)(1). For common carriers, forfeiture penalties may be up to $160,000 for each violation or each day of a continuing violation but may not exceed $1,575,000 for any “single act or failure to act.” Id. § 503(b)(2)(B); 47 C.F.R. § 1.80(b)(2). 153 Any person who “willfully and knowingly” violates the Act’s requirements may be fined up to $10,000 and imprisoned up to one year, and anyone who “willfully and knowingly” violates any FCC “rule, regulation, restriction or condition” made under the authority of the Act shall be fined up to $500 for “each and every day during which such offense occurs.” 47 U.S.C. §§ 501–502. 154 Common carriers violating the Act “shall be liable to the person or persons injured thereby for the full amount of damages,” along with reasonable attorney fees. Id. § 206. 155 “Cable operators” are defined to include anyone who uses the “cable system” to provide any video or other programming service. Id. §§ 522(5)–(6). 156 “Satellite carriers” are defined as any “entity that uses the facilities of a satellite or satellite service . . . to establish and operate a channel of communications for point-to-multipoint distribution of television station signals . . . .” Id.§ 338(k)(7); 17 U.S.C. § 119(d)(6). Congressional Research Service 17 Data Protection Law: An Overview treat their subscribers’157 “personally identifiable information” (PII).158 These requirements relate to: (1) data collection and disclosure; (2) subscribers’ access to, and correction of, their data; (3) data destruction; (4) privacy policy notification; and (5) data security. First, covered entities must obtain the “prior written or electronic consent” of a subscriber before collecting the subscriber’s PII or disclosing it to third parties.159 There are several exceptions to this consent requirement. Among other things, covered entities may collect a subscriber’s PII in order to obtain information necessary to render service to the subscriber,160 and they may disclose a subscriber’s PII if the disclosure is necessary to “render or conduct a legitimate business activity” related to the service they provide.161 Second, covered entities must provide subscribers, at “reasonable times and a convenient place,” with access to all of their PII “collected and maintained,” and they must further provide subscribers a reasonable opportunity to correct any error in such information.162 Third, covered entities are obligated to destroy PII if it is “no longer necessary for the purpose for which it is was collected” and there are “no pending requests or orders for access to such information.”163 Fourth, covered entities must provide subscribers with a privacy policy notice at the “time of entering into an agreement” for services and “at least once a year thereafter.”164 These notices must describe, among other things: (1) the nature of the subscriber’s PII that has been, or will be, collected, (2) the nature, frequency, and purpose of any disclosure of such information and the types of persons to whom the disclosure is made, and (3) the times and place at which the subscriber may have access to such information.165 Lastly, the Communications Act imposes a general data security requirement on covered entities; they must “take such actions as are necessary to prevent unauthorized access to [PII] by a person other than the subscriber” or the covered entity.166 157 FCC regulations define a “subscriber” in the “context of cable of service” as “a member of the general public who receives broadcast programming distributed by a cable television system and does not further distribute it.” 47 C.F.R. § 76.5(ee)(1). FCC regulations further define a “subscriber” in the “context of satellite service” as “a person who receives a secondary transmission service from a satellite carrier and pays a fee for the service, directly or indirectly, to the satellite carrier or to a distributor.” Id. § 76.5(ee)(2). 158 The Communications Act only defines PII as information that “does not include any record of aggregate data which does not identify particular persons.” 47 U.S.C. §§ 338(i)(2)(A), 551(a)(2)(A). See also Klimas v. Comcast Cable Commc’ns, Inc., 465 F.3d 271, 275 (6th Cir. 2006) (“The phrase ‘personally identifiable information’ is not defined in the statute except in the negative. The term ‘does not include any record of aggregate data which does not identify particular persons.’”). 159 47 U.S.C. §§ 338(i)(3)–(4), 551(b)–(c). 160 Id. §§ 338(i)(3)(B), 551(b)(2)(A). Cable operators are also allowed to collect PII without the prior written or electronic consent in order to “detect unauthorized reception of cable communications,” and satellite carriers may similarly collect PII in order to “detect unauthorized reception of satellite communications.” Id. §§ 338(i)(3)(B), 551(b)(2)(B). 161 Id. §§ 338(i)(4)(B), 551(c)(2)(B). Covered entities may also disclose PII without consent include situations where: (1) the disclosure is made pursuant to a court order; (2) the disclosure (i) only consists of a subscriber’s name and address, (ii) the covered entity has given the subscriber the “opportunity to prohibit or limit such disclosure,” and (iii) the disclosure does not reveal the “extent of any viewing or other use by the subscriber” of the service provided or “the nature of any transaction made by the subscriber”; or (3) the disclosure is authorized by a government entity and the disclosure does not include records revealing the subscriber’s selection of video programming. Id. §§ 338(i)(4)(B), 553(c)(2). 162 Id. §§ 338(i)(5), 551(d). 163 Id. §§ 338(i)(6), 551(e). 164 Id. §§ 338(i)(1), 551(a)(1). 165 Id. 166 Id. §§ 338(i)(4)(A), 551(c)(1). Congressional Research Service 18 Data Protection Law: An Overview The Communications Act provides a private right of action for “[a]ny person aggrieved by any act” of a covered entity in violation of these requirements.167 In such actions, a court may award actual damages, punitive damages, and reasonable attorneys’ fees and other litigation costs.168 Additionally, covered entities violating these provisions may be subject to FCC civil enforcement and criminal penalties that, as previously noted, are generally applicable to violations of the Communications Act.169 Video Privacy Protection Act The Video Privacy Protection Act (VPPA)170 was enacted in 1988 in order to “preserve personal privacy with respect to the rental, purchase, or delivery of video tapes or similar audio visual materials.”171 The VPPA does not have any data security provisions requiring entities to maintain safeguards to protect consumer information from unauthorized access. However, it does have privacy provisions restricting when covered entities can share certain consumer information. Specifically, the VPPA prohibits “video tape service providers”172—a term that includes both digital video streaming services and brick-and-mortar video rental stores173—from knowingly disclosing PII174 concerning any “consumer”175 without that consumer’s opt-in consent.176 The VPPA provides several exceptions to this general rule. In particular, video tape service providers may disclose PII to “any person if the disclosure is incident to the ordinary course of business.”177 Providers may also disclose PII if the disclosure solely includes a consumer’s name and address and does not identify the “title, description, or subject matter of any video tapes or other audio visual material,”178 and the consumer has been provided with an opportunity to opt out of such disclosure.179 The VPPA does not empower any federal agency to enforce violations of the Act 167 Id. §§ 338(i)(7), 551(f)(1). 168 Id. §§ 338(i)(7), 551(f)(2). 169 Id. §§ 501–503. 170 Video Privacy Protection Act of 1988, Pub. L. No. 100-619, 102 Stat. 3195 (1988) (codified at 18 U.S.C. § 2710). 171 Id. (“An Act . . . to preserve personal privacy with respect to the rental, purchase, or delivery of video tapes or similar audio visual materials.”). 172 “Videotape service provider” is defined as “any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale or delivery of prerecorded video cassette tapes or similar audio visual materials . . .” See 18 U.S.C. § 2710(a)(4). 173 See, e.g., In re Hulu Privacy Litigation, No. C 11-0374, 2012 WL 3282960, at *5–*6 (N.D. Cal. Aug. 10, 2012) (holding that Hulu, a video-streaming business, is a “video tape service provider” under VPPA); Mollett v. Netflix, Inc., No. 5:11–CV–01629, 2012 WL 3731542, at *2 (N.D. Cal., Aug. 17, 2012) (“Netflix does not challenge the allegations that it is a ‘video tape service provider” and a ‘person providing video recording . . . rental services . . .’”). 174 “[T]he term ‘personally identifiable information’ includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider . . . .” 18 U.S.C. § 2710(a)(3). 175 “Consumer” is defined as “any renter, purchaser, or subscriber of goods or services from a video tape service provider.” Id. § 2710(a)(1). 176 Id. § 2710(b). The statute specifies that the consumer must provide “informed, written consent (including through an electronic means using the Internet)” that is “in a form distinct and separate from any form setting forth other legal or financial obligations of the consumer” and includes an opportunity, provided in a “clear and conspicuous manner,” for the “consumer to withdraw on a case-by-case basis or to withdraw from ongoing disclosures, at the consumer’s election.” Id. § 2710(b)(2)(B). 177 Id. § 2710(b)(2)(E). 178 The subject matter of such materials may be disclosed, however, if the disclosure is “for the exclusive use of marketing goods and services directly to the consumer.” Id. § 2710(b)(2)(D). 179 Id. Other exceptions include disclosures to a law enforcement agency pursuant to a warrant and disclosure pursuant to a court order in a civil proceeding. Id. §§ 2710(b)(2)(C), (F). Congressional Research Service 19 Data Protection Law: An Overview and there are no criminal penalties for violations, but it does provide for a private right of action for persons aggrieved by the Act.180 In such actions, courts may award actual damages, punitive damages, preliminary and equitable relief, and reasonable attorneys’ fees and other litigation costs.181 Family Educational Rights and Privacy Act (FERPA) The Family Educational Rights and Privacy Act of 1974 (FERPA)182 creates privacy protections for student education records. “Education records” are defined broadly to generally include any “materials which contain information directly related to a student” and are “maintained by an educational agency or institution.”183 FERPA defines an “educational agency or institution” to include “any public or private agency or institution which is the recipient of funds under any applicable program.”184 FERPA generally requires that any “educational agency or institution” (i.e., covered entities) give parents or, depending on their age, the student185 (1) control over the disclosure of the student’s educational records, (2) an opportunity to review those records, and (3) an opportunity to challenge them as inaccurate. First, with respect to disclosure, covered entities must not have a “policy or practice” of permitting the release of education records or “personally identifiable information contained therein” without the consent of the parent or the adult student.186 This consent requirement is subject to certain exceptions. Among other things, covered entities may disclose educational records to (1) certain “authorized representatives,”187 (2) school officials with a “legitimate educational interest,”188 or (3) “organizations conducting studies” for covered entities “for the purpose of developing, validating, or administering predictive tests, administering student aid programs, and improving instructions.”189 Covered entities may also disclose the information 180 Id. § 2710(c)(1). 181 Id. § 2710(c)(2). 182 Pub. L. No. 93-380, § 513, 88 Stat. 484, 571–74 (1974) (codified at 20 U.S.C. § 1232g). 183 Id. § 1232g(a)(4)(A). However, FERPA excludes certain things from the “education records” definition, specifically: (1) records made by “instructional, supervisory, and administrative personnel” that are kept “in the sole possession of the maker thereof and which are not accessible or revealed to any other person except a substitute”; (2) “records maintained by a law enforcement unit of the educational agency or institution that were created by that law enforcement unit for the purpose of law enforcement”; and (3) records made or maintained by a “physician, psychiatrist, psychologist or other recognized professional or paraprofessional” on a student who is “eighteen years of age or older, or is attending an institution of postsecondary education,” that are only used “in connection with the provision of treatment” and are “not available to anyone other than the person providing such treatment,” except for a “physician or other appropriate professional of the student’s choice.” Id. § 1232g(a)(4)(B). 184 Id. § 1232g(a)(3). 185 FERPA rights transfer from the parent to the student once the student turns 18 years old or attends a postsecondary institution. Id. § 1232g(d). 186 Id. § 1232g(b). 187 Specifically, this exemption applies to “authorized representatives” of “the Comptroller General of the United States,” “the Secretary [of Education],” “State educational authorities,” or “authorized representatives of the Attorney General for law enforcement purposes.” Id. § 1232g(b)(C). Department of Education regulations further define the term “authorized representative” as meaning “any entity or individual designated by a State or local educational authority or an agency headed by [the Comptroller General, Attorney General, or the Secretary of Education] to conduct—with respect to Federal- or State-supported education programs—any audit or evaluation, or any compliance or enforcement activity in connection with Federal legal requirements that relate to these programs.” 34 C.F.R. § 99.3(b). 188 20 U.S.C. § 1232g(b)(1)(A). 189 Id. § 1232g(b)(1)(F). These studies must be conducted in “such a manner as will not permit the personal identification of students and their parents by persons other than representatives of such organizations,” and the Congressional Research Service 20 Data Protection Law: An Overview without consent if it constitutes “directory information”190 and the entity has given notice and a “reasonable period of time” to opt out of the disclosure.191 Second, in addition to the disclosure obligations, covered entities must not have a “policy of denying” or “effectively prevent[ing]” parents or an adult student from inspecting and reviewing the underlying educational records.192 Covered entities must further “establish appropriate procedures” to grant parents’ review requests “within a reasonable period of time, but in no case more than forty-five days after the request has been made.”193 Lastly, covered entities must provide an “opportunity for a hearing” to challenge the contents of the student’s education records as “inaccurate, misleading, or otherwise in violation of the privacy rights of students.”194 Covered entities must further “provide an opportunity for the correction or deletion of any such inaccurate, misleading or otherwise inappropriate data contained therein and to insert into such records a written explanation of the parents respecting the content of such records.”195 Parents or adult students who believe that their rights under FERPA have been violated may file a complaint with the Department of Education.196 FERPA authorizes the Secretary of Education to “take appropriate actions,” which may include withholding federal education funds, issuing a “cease and desist order,” or terminating eligibility to receive any federal education funding.197 FERPA does not, however, contain any criminal provisions or a private right of action.198 Federal Securities Laws While federal securities statutes and regulations do not explicitly address data protection, two requirements under these laws have implications for how companies prevent and respond to data breaches. First, federal securities laws may require companies to adopt controls designed to protect against data breaches. Under Section 13(b)(2)(B) of the Securities and Exchange Act of 1934 (Exchange information must be “destroyed when no longer needed for the purpose which it is conducted.” Id. Other exceptions to the consent requirement include the disclosure of educational records: (1) to “officials of other schools or school systems in which the student seeks or intends to enroll, upon condition that the student’s parents be notified of the transfer, receive a copy of the record if desired, and have an opportunity for a hearing to challenge the content of the record”; (2) “in connection with a student’s application for, or receipt of, financial aid”; (3) to “appropriate persons” necessary to “protect the health or safety of the student or other person” in connection with an “emergency”; (4) to “accrediting organizations in order to carry out their accrediting functions”; (5) to parents of a student who is a “dependent” as defined in the Internal Revenue Code; or (6) to comply with a subpoena. Id. § 1232g(b). 190 FERPA defines “directory information” as “the student’s name, address, telephone listing, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance, degrees and awards received, and the most previous educational agency or institution attended by the student.” Id. § 1232g(5)(A). 191 Id. § 1232g(a)(5)(B). 192 Id. § 1232g(a)(1)(A). 193 Id. § 1232g(a)(1)(A). 194 Id. § 1232g(a)(2). 195 Id. 196 34 C.F.R. § 99.63. 197 20 U.S.C. § 1232g(f); 34 C.F.R. § 99.67. 198 See Gonzaga University v. Doe, 536 U.S. 273, 290 (2002) (“FERPA’s nondisclosure provisions contain no rightscreating language, they have an aggregate, not individual, focus, and they serve primarily to direct the Secretary of Education’s distribution of public funds to educational institutions.”). Congressional Research Service 21 Data Protection Law: An Overview Act),199 public companies and certain other companies200 are required to “devise and maintain a system of internal accounting controls sufficient to provide reasonable assurances” that “transactions are executed in accordance with management’s general or specific authorization,” and that “access to assets is permitted only in accordance with management’s general or specific authorization.”201 In a recent report, the Securities and Exchange Commission (SEC) suggested that, in order to comply with this requirement, companies should consider “cyber-related threats” when formulating accounting controls.202 The report discussed the SEC’s investigation of companies that wrongly transferred millions of dollars in response to fraudulent emails, generally noting that “companies should pay particular attention to the obligations imposed by Section 13(b)(2)(B)” in light of the “risks associated with today’s ever expanding digital interconnectedness.”203 Second, federal securities laws may require companies to discuss data breaches when making required disclosures under securities laws. The Exchange Act, Securities Act of 1933 (Securities Act),204 and their implementing regulations205 require certain companies to file a number of disclosures with the SEC. Specifically, the Securities Act requires companies issuing securities in a public offering to file detailed statements registering the offering (registration statements),206 and the Exchange Act requires public companies to file periodic reports on an annual, quarterly, and ongoing basis.207 These filings must contain certain categories of information, such as a description of the most significant factors that make investing in the company speculative or risky (known as “risk factors”)208 and a description of any “events, trends, or uncertainties that are reasonably likely to have a material effect on its results of operations, liquidity, or financial condition . . . .”209 Further, when making these filings, or any other statements in connection with the purchase or sale of a security, companies are required to include any “material”210 information necessary to make the statements made therein “not misleading.”211 In interpretive guidance 199 15 U.S.C. §§ 78a–78qq. 200 Companies are subject to these obligations if they have a class of securities registered with the Securities and Exchange Commission (SEC) under Section 12 of the Exchange Act or if they must file reports with the SEC under Section 15(d) of the Exchange Act. Id. § 78m(b)(2). Such companies include all companies with securities traded on a national securities exchange, such as the New York Stock Exchange or the Nasdaq Stock Market. Id. § 78l. 201 Id. §§ 78m(b)(2)(B)(i), (iii). 202 SEC. EXCHANGE COMM’N, SEC RELEASE NO. 34-84429, REPORT OF INVESTIGATION PURSUANT TO 21(A) OF THE SECURITIES AND EXCHANGE ACT OF 1934 REGARDING CERTAIN CYBER-RELATED FRAUDS PERPETRATED AGAINST PUBLIC COMPANIES AND RELATED INTERNAL ACCOUNTING CONTROLS REQUIREMENTS (Oct. 16, 2018), https://www.sec.gov/ litigation/investreport/34-84429.pdf. 203 Id. at 5. 204 15 U.S.C. §§ 77a–77aa. 205 17 C.F.R. Pts. 200–301. 206 15 U.S.C. §§ 77f–77g. 207 Id. § 78m; 17 C.F.R. §§ 240.13a-1, 240.13a-11, 240.13a-13. 208 17 C.F.R. § 229.503(c). 209 Commission Statement on Guidance on Public Company Cybersecurity Disclosures, 83 Fed Reg. 8166, 8170 (Feb. 26, 2018). 210 The Supreme Court has explained that for an omitted fact to be “material” there “must be a substantial likelihood that the disclosure of the omitted fact would have been viewed by the reasonable investor as having significantly altered the ‘total mix’ of information made available.” Basic Inc. v. Levinson, 485 U.S. 224, 231–232 (1988) (quoting TSC Industries v. Northway, Inc., 426 U.S. 438, 449 (1976)). 211 15 U.S.C. § 77k (imposing liability where “any part of the registration statement . . . contained an untrue statement of material fact or omitted to state a material fact required to be stated therein or necessary to make the statements therein not misleading . . . “); id. § 77l (imposing liability on “[a]ny person who . . . offers or sells a security . . . by Congressional Research Service 22 Data Protection Law: An Overview issued in February 2018, the SEC indicated that, pursuant to these obligations, companies may be required to disclose in their filings cyber incidents such as data breaches.212 The SEC can enforce violations of the Securities Act and the Exchange Act, including the accounting controls requirement and the disclosure requirements, through civil actions filed in court213 or administrative “cease and desist” proceedings.214 The SEC may seek civil penalties, disgorgement, and injunctive relief (in civil actions) or a cease and desist order (in administrative proceedings).215 Furthermore, under both the Exchange Act and the Securities Act, individuals aggrieved by a company’s misrepresentation or omission of a material fact in connection with the purchase or sale of a security may sue the company for actual damages incurred by the individual.216 There is not, however, a private right of action for violations of the Exchange Act’s accounting controls requirement.217 Lastly, in addition to civil enforcement, both the Securities Act and the Exchange Act impose criminal liability; any person who “willfully” violates the acts or their implementing regulations may be subject to fines and imprisonment. 218 means of a prospectus or oral communication, which includes an untrue statement of material fact or omits to state a material fact necessary in order to make the statements, in light of the circumstances under which they were made, not misleading . . .”); id. § 78j (“It shall be unlawful for any person . . . [t]o use or employ, in connection with the purchase or sale of any security registered on a national securities exchange or any security not so registered . . . any manipulative or deceptive device or contrivance in contravention of such rules and regulations as the Commission may prescribe . . . .”); 17 C.F.R. § 240.10b-5 (“It shall be unlawful for any person . . . to make any untrue statement of a material fact or to omit to state a material fact necessary in order to make the statements made, in the light of the circumstances under which they were made, not misleading . . . .”). 212 83 Fed Reg. 8166. The SEC guidance does not provide a bright-line approach defining when companies must report cyber incidents. Rather, it generally directs companies to consider whether they are required to discuss such incidents as part of the required categories of disclosure, such as the risk factors or the description of events impacting the company’s operations. Id. at 8169–8171. It further directs companies to consider whether cyber incidents are “material” and whether disclosure is required to make the filings “not misleading.” Id. at 8168–8169. When evaluating materiality, the guidance explains that relevant factors include the nature of the compromised information, potential magnitude of the breach, and range of harm caused by the breach. Id. at 8169. 213 15 U.S.C. §§ 77t(d), 78u(d). 214 Id. §§ 77h-1, 78u-3. 215 Id. §§ 77h-1, 77t, 78u, 78u-2, 78u-3. 216 Id. § 77l (providing a private right of action to investors who purchased a security from someone who offered or sold a security by means of a prospectus or oral communication containing an untrue statement of a material fact or omission of a material fact); Halliburton Co. v. Erica P. John Fund, Inc., 573 U.S. 258, 267 (2014) (“Although section 10(b) does not create an express private cause of action, we have long recognized an implied private cause of action to enforce the provision and its implementing regulation.”); Pelletier v. Stuart-James Co., Inc., 863 F.2d 1550, 1557 (11th Cir. 1989) (“In securities fraud cases, therefore, damages are determined in accordance with the extent to which a plaintiff is actually damaged as a result of the defendant’s fraudulent conduct.”). 217 See, e.g., In re Remec Inc. Sec. Litig., 388 F. Supp. 2d. 1170, 1177 (S.D. Cal. 2005) (“The parties recognize that there is no private right of action under § 78m(b)(2) . . . .”); Eisenberger v. Spectex Indus., Inc., 644 F. Supp. 48, 51 (E.D.N.Y. 1986) (“The court holds that no private cause of action exists under section 78m(b)(2).”); Lewis v. Sporck, 612 F. Supp. 1316, 1333 (N.D. Cal. 1985) (“I conclude that Section 13(b)(2) was not enacted to provide private litigants another cause of action . . . .”). 218 15 U.S.C. §§ 77x, 78ff(a). Congressional Research Service 23 Data Protection Law: An Overview Children’s Online Privacy Protection Act (COPPA) The Children’s Online Privacy Protection Act (COPPA)219 and the FTC’s implementing regulations220 regulate the online collection and use of children’s information.221 Specifically, COPPA’s requirements apply to: (1) any “operator”222 of a website or online service that is “directed to children,” or (2) any operator that has any “actual knowledge that it is collecting personal information from a child” (i.e., covered operators).223 Covered operators must comply with various requirements regarding data collection and use, privacy policy notifications, and data security. First, COPPA and the FTC’s implementing regulations prohibit covered operators from collecting or using “personal information”224 from children under the age of thirteen without first obtaining parental consent.225 Such consent must be “verifiable” and must occur before the information is collected.226 Second, covered operators must provide parents with direct notice of their privacy policies, describing their data collection and sharing policies.227 Covered operators must further post a “prominent and clearly labeled link” to an online notice of its privacy policies at the home page of its website and at each area of the website in which it collects personal information from children.228 Lastly, covered operators that have collected information from children must establish and maintain “reasonable procedures” to protect the “confidentiality, security, and integrity” of the information, including ensuring that the information is provided only to third parties that will similarly protect the information.229 They must also comply with certain data retention and deletion requirements.230 Under COPPA’s safe harbor provisions, covered operators will be 219 Id. §§ 6501–6506. 220 16 C.F.R. pt. 312. 221 Id. §§ 6501–6506. 222 “Operator” is defined as “any person who operates a Web site located on the Internet or an online service and who collects or maintains personal information from or about the users of or visitors to such Web site or online service, or on whose behalf such information is collected or maintained, or offers products or services for sale through that Web site or online service,” but does not include any “nonprofit entity that would otherwise be exempt from coverage under Section 5 of the Federal Trade Commission Act.” 16 C.F.R. § 312.2. 223 15 U.S.C. § 6502; 16 C.F.R. § 312.3. 224 “Personal information” is defined as “individually identifiable information about an individual collected online, including—(A) a first and last name; (B) a home or other physical address including street name and name of a city or town; (C) an e-mail address; (D) a telephone number; (E) a Social Security number; (F) any other identifier that the Commission determines permits the physical or online contacting of a specific individual; or (G) information concerning the child or parents of that child that the website collects online from the child and combines with an identifier described in this paragraph.” 15 U.S.C. § 6501(8). FTC regulations further define “personal information” as including (1) a “persistent identifier that can be used to recognize a user over time and across different Web sites or online services,” such as “a customer number held in a cookie, an Internet Protocol (IP) address, a processor or device serial number, or unique device identifier”; (2) a “photograph, video, or audio file where such file contains a child’s image or voice”; or (3) “[g]eolocation information sufficient to identify street name and name of a city or town.” 16 C.F.R. § 312.2. 225 15 U.S.C. §§ 6502(a)–(b). 226 Id. § 6502(b)(1)(A)(ii); 16 C.F.R. § 312.5(a)(1). See also United States v. UMG, No. cv-04-1050 (C.D. Cal. 2004) (settlement decree), https://www.ftc.gov/sites/default/files/documents/cases/2004/02/040217cagumgrecordings.pdf (settling charges that website operator violated COPPA by notifying parents after it collected the children’s information). 227 15 U.S.C. § 6502(b)(1)(A)(i); 16 C.F.R. §§ 312.4(a), (c). 228 16 C.F.R § 312.4(d). 229 Id. § 312.8. 230 Operators may only retain children’s personal information for “as long as is reasonably necessary to fulfill the Congressional Research Service 24 Data Protection Law: An Overview deemed to have satisfied these requirements if they follow self-regulatory guidelines the FTC has approved.231 COPPA provides that violations of the FTC’s implementing regulations will be treated as “a violation of a rule defining an unfair or deceptive act or practice” under the FTC Act.232 Under the FTC Act, as discussed in more detail below, the FTC has authority to enforce violations of such rules by seeking penalties or equitable relief.233 COPPA also authorizes state attorneys general to enforce violations affecting residents of their states.234 COPPA does not contain any criminal penalties235 or any provision expressly providing a private right of action.236 Electronic Communications Privacy Act (ECPA) The Electronic Communications Privacy Act (ECPA) was enacted in 1986,237 and is composed of three acts: the Wiretap Act,238 the Stored Communications Act (SCA),239 and the Pen Register Act.240 Much of ECPA is directed at law enforcement, providing “Fourth Amendment like privacy protections” to electronic communications.241 However, ECPA’s three acts also contain privacy obligations relevant to non-governmental actors. ECPA is perhaps the most comprehensive federal law on electronic privacy, as it is not sector-specific, and many of its provisions apply to a wide range of private and public actors. Nevertheless, its impact on online privacy practices has been limited. As some commentators have observed, ECPA “was designed to regulate wiretapping and electronic snooping rather than commercial data gathering,” and litigants attempting to apply ECPA to online data collection have generally been unsuccessful.242 purpose for which the information was collected” and must “delete such information using reasonable measures to protect against unauthorized access to, or use of, the information in connection with its deletion.” Id. § 312.10. 231 15 U.S.C. § 6503; 16 C.F.R. § 312.11. 232 15 U.S.C. § 6502(c). 233 Id. § 45(m)(1)(A). For further discussion of the FTC’s enforcement authority under the FTC Act, see § Federal Trade Commission Act (FTC Act), infra. 234 Id. § 6504. 235 See, e.g., John Soma, J. Zachary Courson, & John Cadkin, Corporate Privacy Trend: The “Value” of Personally Identifiable Information (“PII”) Equals the “Value” of Financial Assets, 15 RICH. J. L. & TECH. 11, 30 (2009) (“COPPA does not carry criminal penalties”). 236 Moreover, no court appears to have considered whether an implied right of action can be read into COPPA. However, the Supreme Court has explained that Congress must create private rights of action in “clear and unambiguous terms,” Gonzaga University v. Doe, 536 U.S. 273, 290 (2002) (“In sum, if Congress wishes to create new rights enforceable under § 1983, it must do so in clear and unambiguous terms—no less and no more than what is required for Congress to create new rights enforceable under an implied private right of action.”), suggesting that Congress did not create a private cause of action under COPPA. See Dorothy Hertzel, Don’t Talk to Strangers: an Analysis of Government and Industry Efforts to Protect a Child’s Privacy Online, 52 FED. COMM. L. J. 429, 439 (2000) (“The COPPA does not provide parents or children with a private right of action . . .”). 237 Electronic Communications Privacy Act of 1986, Pub. L. No. 99-508, 100 Stat. 1848 (1986) (codified at 18 U.S.C. §§ 2510–3127). 238 18 U.S.C. §§ 2510–2523. 239 Id. §§ 2701–2713. 240 Id. §§ 3121–3127. 241 Kerr, supra note 62, at 1212 (“[T]he [SCA] creates a set of Fourth Amendment-like privacy protections by statute, regulating the relationship between government investigators and service providers in possession of users’ private information.”); see also Suzlon Energy Ltd. v. Microsoft Corp., 671 F.3d 726, 730 (9th Cir. 2011) (noting that “ECPA was intended to shore up Fourth Amendment rights”). 242 Solove & Hartzog, supra note 60, at 592 (“An attempt was made early on to apply existing statutory law to online Congressional Research Service 25 Data Protection Law: An Overview The Wiretap Act applies to the interception of a communication in transit. A person violates the Act if, among other acts,243 he “intentionally intercepts . . . any wire, oral, or electronic communication.”244 The Wiretap Act defines an “electronic communication” broadly, and courts have held that the term include [Text truncated at 120,000 characters. The full text is on the page linked above.] --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/crs%3AR45631. Public record. Not legal advice.