Anatomy of a Privacy Law

Daniel Solove
Founder of TeachPrivacy

Anatomy of a Privacy Law - Prof Daniel Solove 01

I was recently giving a presentation about new privacy laws, and I created the infographic above to catalog the various elements that privacy laws often have.  Going through this list can help to assess how complete a privacy law is.  For example, the California Consumer Privacy Act (CCPA) is often compared to the General Data Protection Regulation (GDPR), and I’ve heard it sometimes referred to as a GDPR in the United States.  But the CCPA is far different from the GDPR, as the GDPR is significantly more comprehensive and has many more dimensions than the CCPA.  For example, the GDPR has a broader scope (covers more types of entities) and has many provisions about responsibilities and governance that the CCPA lacks.   Indeed, the GDPR has most of the elements in this list. In the US, HIPAA comes the closest to the GDPR in terms of how many items it has from the last, but HIPAA is just limited to certain forms of health data.

Click here for a larger PDF version of the infographic.

The vast majority of privacy laws have provisions relating to their scope and applicability, a definition of the personal information that they regulate, individual rights and organizational responsibilities, enforcement provisions, and a particular position with regard to preemption.

Continue Reading

Will the United States Finally Enact a Federal Comprehensive Privacy Law?

Daniel Solove
Founder of TeachPrivacy

Comprehensive Privacy Law US - TeachPrivacy CCPA Training 01

These days, there seems to be a lot of energy around a federal comprehensive privacy law in the United States.  When the US Congress started passing privacy laws in the 1970s, 80s, and 90s, it eschewed the route of passing a comprehensive privacy law, opting instead for the sectoral approach — passing a series of narrow industry-specific laws.  Then, in the late 1990s and early 2000s, there was a brief debate in the US about passing a comprehensive privacy law, when a few companies suggested it.  But most companies shot down the idea. They liked the sectoral approach. They were okay with being regulated by a patchwork of various federal and state privacy laws.

At the time, when discussing the issue at conferences and events, I said that this view was short-sighted. The rest of the world was starting to move toward a comprehensive privacy law. The patchwork of laws left many gaps and holes in privacy protection and had countless inconsistencies. Congress did nothing.

Congressional Paralysis and the Rise of the States

Since 2000, Congress has largely been unable to pass many privacy laws. It has largely passed amendments to existing laws, but it hasn’t passed many major pieces of sectoral privacy regulation, let alone a broader privacy law. Partisanship, as well as a lack of compromise and maturity, have rendered Congress unable to craft laws with the nuance and balance needed to address privacy and data security issues. During this time, the states have passed a blizzard of laws. Every state has passed a data breach notification law. States have passed countless privacy laws too — especially California.
State Privacy Laws

A New Urge for Congress to Act

The EU’s General Data Protection Regulation (GDPR), which started being enforced in May 2018, and the passage of California’s Consumer Privacy Act (CCPA) have reignited the debate over a comprehensive federal privacy law.   “It’s time,” many people are saying.  Now, industry is crying out for a comprehensive federal law.  In November 2018, in response to a call for comments on a federal privacy law by the NTIA, numerous companies responded by stating that they were now in favor of a federal privacy law.

But with this Congress, I think that a comprehensive privacy law is unlikely.

Continue Reading

Privacy Law Fundamentals – New 2019 Edition

Daniel Solove
Founder of TeachPrivacy

Privacy Law Fundamentals 2019 03

I am pleased to announce the publication of the new edition of PRIVACY LAW FUNDAMENTALS, my short guide to privacy law with Prof Paul Schwartz.  The purpose of this compact treatise is to distill the vast terrain of privacy law to the essential cases, regulations, statutes, and other notable developments.  We aim to provide what you need to know about privacy law in a concise volume that doesn’t weigh 500 pounds. We hope that this book will serve as a privacy law reference that you can readily keep at hand.

You can obtain a copy of the book at the IAPP bookstore.  A lot has happened in privacy law since the last edition because every day there’s something new in this field.  Here’s the table of contents.

Please visit my casebook website — Information Privacy Law — to find out more info about this book, as well as my casebooks with Paul Schwartz.

Continue Reading

Cartoon: The CCPA, a Federal Comprehensive Privacy Law, and Preemption

Daniel Solove
Founder of TeachPrivacy

Cartoon CCPA Preemption - TeachPrivacy CCPA Training 02 small

For years, many policymakers, industry representatives, and commentators were opposed to a comprehensive federal privacy law.  They typical federalism arguments were often trotted out. Then, in 2018, California passed the California Consumer Privacy Act (CCPA). Now, there seems to be a chorus for a comprehensive federal privacy law with preemption.  I’ll be posting soon about my thoughts on a federal law and on preemption.

Continue Reading

Please Join Us at the International Privacy and Security Forum (April 3-5, 2019)

Daniel Solove
Founder of TeachPrivacy

International Privacy and Security Forum

I hope that you can join us for the International Privacy+Security Forum (April 3-5, 2019 in Washington, DC).

The International Privacy+Security Forum is an annual sister event to the Privacy+Security Forum, an annual event held in October at George Washington University in Washington, DC.  The Int’l Forum event focuses on privacy and security laws from around the world.  The main feature of Forum events is that we have deep-dive sessions on topics.  We attract highly seasoned professionals, and we encourage highly interactive sessions.

We will have 100+ speakers and about 40 sessions.

Continue Reading