These days, there seems to be a lot of energy around a federal comprehensive privacy law in the United States. When the US Congress started passing privacy laws in the 1970s, 80s, and 90s, it eschewed the route of passing a comprehensive privacy law, opting instead for the sectoral approach — passing a series of narrow industry-specific laws. Then, in the late 1990s and early 2000s, there was a brief debate in the US about passing a comprehensive privacy law, when a few companies suggested it. But most companies shot down the idea. They liked the sectoral approach. They were okay with being regulated by a patchwork of various federal and state privacy laws.
At the time, when discussing the issue at conferences and events, I said that this view was short-sighted. The rest of the world was starting to move toward a comprehensive privacy law. The patchwork of laws left many gaps and holes in privacy protection and had countless inconsistencies. Congress did nothing.
Congressional Paralysis and the Rise of the States
Since 2000, Congress has largely been unable to pass many privacy laws. It has largely passed amendments to existing laws, but it hasn’t passed many major pieces of sectoral privacy regulation, let alone a broader privacy law. Partisanship, as well as a lack of compromise and maturity, have rendered Congress unable to craft laws with the nuance and balance needed to address privacy and data security issues. During this time, the states have passed a blizzard of laws. Every state has passed a data breach notification law. States have passed countless privacy laws too — especially California.
A New Urge for Congress to Act
The EU’s General Data Protection Regulation (GDPR), which started being enforced in May 2018, and the passage of California’s Consumer Privacy Act (CCPA) have reignited the debate over a comprehensive federal privacy law. “It’s time,” many people are saying. Now, industry is crying out for a comprehensive federal law. In November 2018, in response to a call for comments on a federal privacy law by the NTIA, numerous companies responded by stating that they were now in favor of a federal privacy law.
But with this Congress, I think that a comprehensive privacy law is unlikely.
For years, many policymakers, industry representatives, and commentators were opposed to a comprehensive federal privacy law. They typical federalism arguments were often trotted out. Then, in 2018, California passed the California Consumer Privacy Act (CCPA). Now, there seems to be a chorus for a comprehensive federal privacy law with preemption. I’ll be posting soon about my thoughts on a federal law and on preemption.
Massachusetts — $75,000 settlement with McLean Hospital for a data breach involving 1,500 victims based on an employee who routinely took home unencrypted backup tapes with PHI. From the state press release:
The AG’s complaint alleges that McLean, a psychiatric hospital in Belmont, allowed an employee to regularly take home eight unencrypted back-up tapes containing clinical and demographic information from the Harvard Brain Tissue Resource Center that the hospital possessed. The tapes contained personal information such as names, social security numbers, diagnoses and family histories. When the employee was terminated from her position at McLean in May 2015, she only returned four of the tapes, and the hospital was unable to recover the others.
New Jersey — $100,000 settlement with EmblemHealth for a 2016 breach involving 81,000 victims. Details from the state’s press release:
The incident at issue took place on October 3, 2016 when EmblemHealth’s vendor sent a paper copy of EmblemHealth’s Medicare Part D Prescription Drug Plan’s Evidence of Coverage to 81,122 of its customers, including 6,443 who live in New Jersey.
The label affixed to the mailing improperly included each customer’s HICN, which incorporates the nine digits of the customer’s Social Security number, as well as an alphabetic or alphanumeric beneficiary identification code. (The number shown was identified as the “Package ID#” on the mailing label and did not include any separation between the digits.)
During its investigation, the Division found that following the departure of the EmblemHealth employee who typically prepared the Evidence of Coverage mailings, the task was assigned to a team manager of EmblemHealth’s Medicare Products Group, who received minimal training specific to the task and worked unsupervised. Before forwarding the data file to the print vendor, this team manager failed to remove the patient HICNs from the electronic data file.
On December 4, 2018, New York Attorney General Barbara D. Underwood announced a $4.95 million settlement with Oath, Inc. (formerly known as AOL), for violating the Children’s Online Privacy Protection Act (COPPA). This is the largest penalty in a COPPA enforcement case in U.S. history.