PRIVACY + SECURITY BLOG

News, Developments, and Insights

high-tech technology background with eyes on computer display

ALI Principles of Law, Data Privacy

ALI Principles of Law Data Privacy

I’m thrilled that, the American Law Institute (ALI) has approved the Principles of the Law, Data Privacy. Professor Paul Schwartz and I were co-reporters on the project.  According to the ALI press release: “The Principles seek to provide a set of best practices for entities that collect and control data concerning individuals and guidance for a variety of parties at the federal, state, and local levels, including legislators, attorneys general, and administrative agency officials.”

The project involves our attempt to create a comprehensive approach to data privacy for the U.S. that bridges the divide with the EU.  For example, there are many provisions in the General Data Protection Regulation (GDPR) that are not as incompatible with U.S. law as one might think.  We bring U.S. law most of the way there, but we preserve core commitments in U.S. law that cannot readily be made consistent with the EU approach. We also have some new approaches to certain issues that haven’t yet been tried in quite the same ways in other laws before, such as our approach to transparency and notice, as well as our approach to handling the identifiability of personal data.  The Principles of the Law, Data Privacy is not an attempt to write our ideal privacy law as if drafting on a blank slate.  Nor is it an attempt to restate existing law. Instead, it is something in between. We build on foundations in existing law, look for ways the law can be advanced progressively without clashing with core commitments or introducing concepts that are without precedent.

ALI Principles of the Law Data Privacy

Thus, our goal has been to produce a balanced compromise, an approach to advance U.S. privacy law significantly without being radical.  I am certain industry and advocates will find things they like and things that they wish were different.  This isn’t the law I’d write if I were writing on a blank slate. But it is, I hope, a big step forward.

We hope this project is useful to legislatures working on privacy legislation, to other policymakers, and to everyone who is thinking about privacy law.

We want to thank our advisory group and the ALI members who contributed greatly to this project. The ALI process is a wonderful one — a thoughtful constructive discussion about how to craft meaningful regulation between practitioners, judges, and academics, among others.

The final draft will be released very soon.  Paul and I will be posting the blackletter portion of the project. The entire document, which consists of our commentary, notes, and illustrations — including the support for and rationales behind the provisions — will be available from the ALI.  Please stay tuned.

As a teaser, below is the table of contents

Continue Reading

A Major Move to Weaken HIPAA

HIPAA Penalties Reduced

Quietly, at the end of April, HIPAA was significantly weakened.  HHS published what sounds like an innocuous notification in the Federal Register: Notification of Enforcement Discretion Regarding HIPAA Civil Money Penalties.  This notification is actually an enormous change to the HIPAA penalty structure, a drastic reduction in HIPAA fines.

The existing penalty structure under HIPAA is based on the HITECH Act of 2009, which increased HIPAA’s fines in an attempt to give teeth to HIPAA enforcement.  Since HIPAA began being enforced in 2003 until the HITECH Act, fines had barely been issued despite an enormous amount of HIPAA violations.  HITECH was Congress’s rebuff to this weak enforcement approach.  After HITECH’s more potent penalty structure, HHS finally began issuing fines.  The chart below is how HHS has been interpreting the HITECH penalty framework since the HITECH Act:

HIPAA Penalties Table 1

There were some ambiguities under the HITECH Act as to these penalty tiers, but HHS had long interpreted these tiers according to the above chart.  But now, HHS has suddenly changed its mind and adopted a very different interpretation. Under this new interpretation, the penalty tier limits are now as follows:

HIPAA Penalties Table 2

Notice the new annual limits.  There are severe reductions in the annual limits for nearly every category except for uncorrected willful neglect. This change yanks many of the teeth out of HIPAA enforcement.Teeth Pulling

Continue Reading

Cartoon: Data Minimization

Cartoon Data Minimization - TeachPrivacy Privacy Awareness Training 02 small

This privacy cartoon is about data minimization, a principle embodied in many privacy laws.  Under the data minimization principle, organizations are to collect, process, or share only the minimum necessary personal data to achieve their purpose.  There’s a lot of hat tipping to data minimization, but this principle is often not followed enough.  Far too often, personal data is collected without any particular purpose in mind and far too much is shared than necessary.

Continue Reading

Privacy Law Fundamentals – New 2019 Edition

Privacy Law Fundamentals 2019 03

I am pleased to announce the publication of the new edition of PRIVACY LAW FUNDAMENTALS, my short guide to privacy law with Prof Paul Schwartz.  The purpose of this compact treatise is to distill the vast terrain of privacy law to the essential cases, regulations, statutes, and other notable developments.  We aim to provide what you need to know about privacy law in a concise volume that doesn’t weigh 500 pounds. We hope that this book will serve as a privacy law reference that you can readily keep at hand.

You can obtain a copy of the book at the IAPP bookstore.  A lot has happened in privacy law since the last edition because every day there’s something new in this field.  Here’s the table of contents.

Please visit my casebook website — Information Privacy Law — to find out more info about this book, as well as my casebooks with Paul Schwartz.

Continue Reading

Anatomy of a Privacy Law

Anatomy of a Privacy Law - Prof Daniel Solove 01

I was recently giving a presentation about new privacy laws, and I created the infographic above to catalog the various elements that privacy laws often have.  Going through this list can help to assess how complete a privacy law is.  For example, the California Consumer Privacy Act (CCPA) is often compared to the General Data Protection Regulation (GDPR), and I’ve heard it sometimes referred to as a GDPR in the United States.  But the CCPA is far different from the GDPR, as the GDPR is significantly more comprehensive and has many more dimensions than the CCPA.  For example, the GDPR has a broader scope (covers more types of entities) and has many provisions about responsibilities and governance that the CCPA lacks.   Indeed, the GDPR has most of the elements in this list. In the US, HIPAA comes the closest to the GDPR in terms of how many items it has from the last, but HIPAA is just limited to certain forms of health data.

Click here for a larger PDF version of the infographic.

The vast majority of privacy laws have provisions relating to their scope and applicability, a definition of the personal information that they regulate, individual rights and organizational responsibilities, enforcement provisions, and a particular position with regard to preemption.

Continue Reading

Will the United States Finally Enact a Federal Comprehensive Privacy Law?

Comprehensive Privacy Law US - TeachPrivacy CCPA Training 01

These days, there seems to be a lot of energy around a federal comprehensive privacy law in the United States.  When the US Congress started passing privacy laws in the 1970s, 80s, and 90s, it eschewed the route of passing a comprehensive privacy law, opting instead for the sectoral approach — passing a series of narrow industry-specific laws.  Then, in the late 1990s and early 2000s, there was a brief debate in the US about passing a comprehensive privacy law, when a few companies suggested it.  But most companies shot down the idea. They liked the sectoral approach. They were okay with being regulated by a patchwork of various federal and state privacy laws.

At the time, when discussing the issue at conferences and events, I said that this view was short-sighted. The rest of the world was starting to move toward a comprehensive privacy law. The patchwork of laws left many gaps and holes in privacy protection and had countless inconsistencies. Congress did nothing.

Congressional Paralysis and the Rise of the States

Since 2000, Congress has largely been unable to pass many privacy laws. It has largely passed amendments to existing laws, but it hasn’t passed many major pieces of sectoral privacy regulation, let alone a broader privacy law. Partisanship, as well as a lack of compromise and maturity, have rendered Congress unable to craft laws with the nuance and balance needed to address privacy and data security issues. During this time, the states have passed a blizzard of laws. Every state has passed a data breach notification law. States have passed countless privacy laws too — especially California.
State Privacy Laws

A New Urge for Congress to Act

The EU’s General Data Protection Regulation (GDPR), which started being enforced in May 2018, and the passage of California’s Consumer Privacy Act (CCPA) have reignited the debate over a comprehensive federal privacy law.   “It’s time,” many people are saying.  Now, industry is crying out for a comprehensive federal law.  In November 2018, in response to a call for comments on a federal privacy law by the NTIA, numerous companies responded by stating that they were now in favor of a federal privacy law.

But with this Congress, I think that a comprehensive privacy law is unlikely.

Continue Reading

Cartoon: The CCPA, a Federal Comprehensive Privacy Law, and Preemption

Cartoon CCPA Preemption - TeachPrivacy CCPA Training 02 small

For years, many policymakers, industry representatives, and commentators were opposed to a comprehensive federal privacy law.  They typical federalism arguments were often trotted out. Then, in 2018, California passed the California Consumer Privacy Act (CCPA). Now, there seems to be a chorus for a comprehensive federal privacy law with preemption.  I’ll be posting soon about my thoughts on a federal law and on preemption.

Continue Reading

Please Join Us at the International Privacy and Security Forum (April 3-5, 2019)

International Privacy and Security Forum

I hope that you can join us for the International Privacy+Security Forum (April 3-5, 2019 in Washington, DC).

The International Privacy+Security Forum is an annual sister event to the Privacy+Security Forum, an annual event held in October at George Washington University in Washington, DC.  The Int’l Forum event focuses on privacy and security laws from around the world.  The main feature of Forum events is that we have deep-dive sessions on topics.  We attract highly seasoned professionals, and we encourage highly interactive sessions.

We will have 100+ speakers and about 40 sessions.

Continue Reading

Cartoon: Data Breach Notification

Cartoon Data Beach Notification - TeachPrivacy Security Awareness Training 02 small

This cartoon is about data breach notification.  All 50 states plus the District of Columbia and Puerto Rico now have data breach notification laws, and breach notification laws are spreading around the globe.  And, as is often said in data security, it’s not whether a breach will happen, but when . . .

Continue Reading

HIPAA Enforcement 2018

HIPAA Enforcement 2018 - TeachPrivacy HIPAA Training 02

Last year was a record-setting year for HIPAA enforcement.  On HHS’s website, OCR has touted its 2018 enforcement:

OCR has concluded an all-time record year in HIPAA enforcement activity.  In 2018, OCR settled 10 cases and secured one judgment, together totaling $28.7 million. This total surpassed the previous record of $23.5 million from 2016 by 22 percent.  In addition, OCR also achieved the single largest individual HIPAA settlement in history of $16 million with Anthem, Inc., representing a nearly three-fold increase over the previous record settlement of $5.5 million in 2016.

Here is an overview of the resolution agreements and enforcement actions with civil monetary penalties from 2018:

Continue Reading