CIPP/US cheat sheet

U.S. privacy law is sectoral: no single omnibus federal statute; federal statutes target specific data types or industries, supplemented by FTC Act Section 5 and state law.

FTC Act Section 5 prohibits unfair or deceptive acts or practices; deception requires a material representation likely to mislead, and unfairness requires substantial consumer injury not reasonably avoidable and not outweighed by benefits.

Common-law privacy torts (Prosser) are intrusion upon seclusion, public disclosure of private facts, false light, and appropriation; each has distinct elements and defenses.

The Fourth Amendment protects reasonable expectations of privacy against government action, but there is no general constitutional right against private-sector data collection; the First Amendment limits some privacy regulation.

OECD Fair Information Practice Principles include collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation, and accountability.

Federal enforcement is shared: FTC for consumer protection, HHS OCR for HIPAA, CFPB for FCRA and GLBA, state attorneys general, and sector regulators; the FTC Act itself provides no general private right of action.

Cross-border transfers: the EU-U.S. Data Privacy Framework (2023) replaced the invalidated Safe Harbor (2015) and Privacy Shield (2020); adequacy depends on redress and limits on government access.

Self-regulatory and co-regulatory models include DAA and NAI advertising principles and FTC-approved COPPA safe harbor programs; certification can create enforceable commitments.

FTC Act Section 5 applies to offline and online data; deceptive privacy policies, retroactive material changes, and unreasonable security can be unfair or deceptive, often leading to 20-year consent orders.

FCRA: consumer reporting agencies may furnish reports only for permissible purposes; users must have a permissible purpose, provide adverse action notices, and maintain dispute and accuracy procedures.

GLBA: financial institutions must provide privacy notices, allow opt-out before sharing nonpublic personal information with nonaffiliated third parties, and safeguard data under the Safeguards Rule.

HIPAA: covered entities and business associates may use or disclose protected health information for treatment, payment, and operations; other uses require authorization, and the minimum necessary standard applies.

COPPA: operators of child-directed sites or services, or with actual knowledge of collecting data from children under 13, need verifiable parental consent and cannot condition participation on unnecessary data.

CAN-SPAM: commercial email must have accurate header and routing information, a non-deceptive subject line, a physical address, and a clear opt-out honored within 10 business days.

TCPA: autodialed or prerecorded marketing calls and texts to wireless numbers generally require prior express written consent; National Do Not Call Registry rules also apply.

Data minimization and purpose limitation: many state laws and FTC enforcement actions require collecting only data reasonably necessary for a stated purpose and retaining it no longer than needed.

Online tracking: CalOPPA requires privacy policy disclosures and disclosure of how Do Not Track signals are handled; DAA and NAI self-regulatory programs provide interest-based advertising opt-outs.

Fourth Amendment: a government search of an area where a person has a reasonable expectation of privacy generally requires a warrant supported by probable cause; the third-party doctrine limits protection for data voluntarily shared with providers.

Carpenter v. United States (2018) held that acquiring historical cell-site location records is a search generally requiring a warrant; it is a narrow exception and did not broadly overrule the third-party doctrine.

ECPA Wiretap Act (18 U.S.C. 2510) prohibits intentional interception of electronic communications; exceptions include one-party consent and the business-extension exception.

Stored Communications Act (18 U.S.C. 2701): subpoena for basic subscriber information; warrant for content in electronic storage 180 days or less; for older content, warrant, subpoena with notice, or court order under Section 2703(d).

Pen Register/Trap and Trace Act requires a court order for dialing, routing, and signaling information; it does not authorize collection of communication content.

National Security Letters are FBI administrative subpoenas for subscriber, billing, and transactional records; nondisclosure requirements are subject to judicial review.

CLOUD Act (2018): U.S. providers must comply with warrants for electronic data stored abroad, and executive agreements let foreign governments request data directly from U.S. providers.

FISA Section 702 authorizes targeting non-U.S. persons reasonably believed abroad, with certifications, minimization, and oversight; the Section 215 business records program lapsed in 2020.

Civil discovery subpoenas can reach private-sector data; the Privacy Protection Act protects journalists' work product from government searches absent probable cause.

At-will employment allows employers to monitor many workplace communications, but monitoring cannot violate statutory rights, contracts, or public policy; no general federal employee privacy statute exists.

ECPA business-extension exception permits employer monitoring of communications in the ordinary course of business; one-party consent and clear notice policies reduce legal risk.

NLRA Section 7 protects concerted activity; employer surveillance and overly broad social-media or confidentiality policies can be unfair labor practices.

FCRA applies when employers use third-party consumer reports for employment: disclosure, authorization, pre-adverse action notice, and adverse action notice are required.

State social-media password laws, such as California, Illinois, and Michigan, bar employers from requiring employees or applicants to disclose passwords, with exceptions for workplace devices and investigations.

Connecticut and Delaware require notice of electronic monitoring; some states regulate GPS tracking of employees and video surveillance in private areas.

HIPAA generally does not cover employers as employers; the ADA requires confidentiality of medical information, GINA bars genetic information use, and FMLA and workers' compensation create separate confidentiality rules.

Bring-your-own-device policies should address consent to monitoring, remote wipe, data segregation, and exit; NLRB and state law may limit scope.

Comprehensive state laws include California CCPA/CPRA, Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, and others; thresholds often depend on revenue, number of consumers, or percentage of revenue from selling data.

Common consumer rights include access, deletion, correction, portability, opt out of sale, sharing, targeted advertising, or profiling, and non-discrimination; several states also provide appeal rights.

Opt-in consent is required for processing sensitive data and for known children in several comprehensive laws; California requires opt-in for sale or sharing of minors' data.

Processor contracts: state laws require written agreements covering purpose limitation, confidentiality, security, subprocessor obligations, and assistance with consumer requests.

Data protection assessments are required for high-risk processing such as targeted advertising, sensitive data, and profiling in Colorado, Connecticut, Virginia, and others; California requires risk assessments and cybersecurity audits.

Enforcement: most comprehensive state laws are enforced by attorneys general and lack a private right of action; the CCPA has a limited private right for data breaches.

Breach notification: all 50 states, D.C., and territories require notice to affected individuals; timing, attorney general notification thresholds, and content vary.

Illinois BIPA provides a private right of action for biometric identifiers and information; written consent before collection and a retention schedule are required.