Guides: Digital Data Security and Privacy: Legislation

Family/Children

Children's Online Privacy Protection Act of 1998 (COPPA) Federal law which imposes certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age
Family Educational Rights and Privacy Act Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education. FERPA gives parents certain rights with respect to their children's education records. These rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level
Do Not Track Kids Act of 2015 Amends the Children's Online Privacy Protection Act of 1998 to apply the prohibitions against collecting personal information from children to online applications and mobile applications directed to children. Establishes additional privacy protections against the collection of personal or geolocation information from children and minors.

Health Information

Health Insurance Portability and Accountability Act of 1996 (HIPPA) Establishes national standards to protect individuals’ medical records and other personal health information and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically. The Rule requires appropriate safeguards to protect the privacy of personal health information, and sets limits and conditions on the uses and disclosures that may be made of such information without patient authorization. The Rule also gives patients rights over their health information, including rights to examine and obtain a copy of their health records, and to request corrections.
HIPAA Privacy Rule
HIPAA Security Rule

General Privacy Legislation

Freedom of Information Act (FOIA) Generally provides that any person has the right to request access to federal agency records or information except to the extent the records are protected from disclosure by any of nine exemptions contained in the law or by one of three special law enforcement record exclusions. The nine exemptions are: classified information for national defense or foreign policy, internal personnel rules and practices, information that is exempt under other laws, trade secrets and confidential business information, inter-agency or intra-agency memoranda or letters that are protected by legal privileges, personnel and medical files, law enforcement records or information, information concerning bank supervision, or geological and geophysical information.
Privacy Act of 1974 Establishes a code of fair information practices that governs the collection, maintenance, use, and dissemination of information about individuals that is maintained in systems of records by federal agencies. A system of records is a group of records under the control of an agency from which information is retrieved by the name of the individual or by some identifier assigned to the individual.
Right to Financial Privacy Act of 1978 Protects the confidentiality of personal financial records by creating a statutory Fourth Amendment protection for bank records. It establishes specific procedures that government authorities must follow when requesting a customer’s financial records from a bank or other financial institution.
Video Privacy Protection Act of 1988 Passed in reaction to the disclosure of Supreme Court nominee Robert Bork's video rental records in a newspaper. The Act is not often invoked, but stands as one of the strongest protections of consumer privacy against a specific form of data collection. Generally, it prevents disclosure of personally identifiable rental records of "prerecorded video cassette tapes or similar audio visual material."
Driver's Privacy Protection Act of 1994 (DPPA) Federal law limiting occasions when state departments of motor vehicles and authorized recipients may disclose to the public personal information contained in a person’s motor vehicle record, which includes a motor vehicle operator’s permit, motor vehicle title, motor vehicle registration, or identification card issued by a department of motor vehicles. Personal information protected by the DPPA is information that identifies an individual, including an individual’s photograph, Social Security number, driver identification number, name, address (but not zip code), telephone number, and medical or disability information. The DPPA does not protect information about a person’s vehicular accidents, driving violations, and driver’s status.
Wireless Communication and Public Safety Act of 1999 Also known as the 911 Act, the act required the setup of enhanced 911 and mandated that 911 serve as the emergency number for non-land line phones as well. It was an amendment to the Communications Act of 1934 as amended by the Telecommunications Act of 1996. Contents
USA Patriot Act of 2001 Passed 45 days after 9/11 in the name of national security, the Patriot Act was the first of many changes to surveillance laws that made it easier for the government to spy on ordinary Americans by expanding the authority to monitor phone and email communications, collect bank and credit reporting records, and track the activity of all Americans, innocent or criminal, on the Internet.

Advocacy

Digital Realm

Stored Communications Act Law that addresses voluntary and compelled disclosure of "stored wire and electronic communications and transactional records" held by third-party internet service providers (ISPs). It was enacted as Title II of the Electronic Communications Privacy Act of 1986 (ECPA).
Electronic Communications Privacy Act of 1986 (ECPA)
Federal statute that prohibits a third party from intercepting or disclosing communications without authorization. The Act, which was originally passed as an amendment to the Wiretap Act of 1968, applies to both government employees and private citizens. It protects communications in storage as well as in transit.
Computer Matching and Privacy Protection Act of 1988 Amendment to the Privacy Act of 1974 with provisions involving procedural requirements for agencies to follow when engaging in computer-matching activities, provide matching subjects with opportunities to receive notice and to refute adverse information before having a benefit denied or terminated, and require that agencies engaged in matching activities establish Data Protection Boards to oversee those activities.
ACLU v. Clapper, 13 Civ. 3994 (USDC SDNY 2013) 2013 case where the ACLU challenged the legality of the National Security Agency (NSA)'s bulk phone metadata collection program. The court dismissed the case (December, 2013), finding that metadata collection did not violate the Fourth Amendment but on January 2, 2014, the ACLU appealed the ruling to the United States Court of Appeals for the Second Circuit and in May the appeals court ruled that Section 215 of the Patriot Act did not authorize the bulk collection of metadata.
Klayman v. Obama, Civil Action No. 13-0851 (USDC DC 2013) In Klayman I, the plaintiffs, subscribers of Verizon Wireless, brought suit against the NSA, the Department of Justice, Verizon Communications, President Barack Obama, and NSA officials alleging that the government overstepped its bounds by intercepting "vast quantities of domestic telephonic communications" violating First, Fourth and Fifth Amendment rights. In Klayman II, the plaintiffs sued the same government defendants and in addition, Facebook, Yahoo!, Google, Microsoft, YouTube, AOL, PalTalk, Skype, Sprint, AT&T, Apple again alleging the bulk metadata collection violates the First, Fourth and Fifth Amendment. U.S. Federal Judge Richard J. Leon in December 2013 ruled that bulk collection of American telephone metadata likely violates the Constitution of the United States.
Consumer Privacy Protection Act of 2015 Legislation intending to govern the collection and dissemination of consumer data. The Privacy Bill of Rights was a revival of draft legislation the White House first introduced in 2012. It was re-introduced as a companion to the Data Security and Breach Notification Act of 2015.
Data Security and Breach Notification Act of 2015 Law protecting consumers by requiring reasonable security policies and procedures to protect data containing personal information, and to provide for nationwide notice in the event of a breach of security. Require certain entities who collect and maintain personal information of individuals to secure such information and to provide notice to such individuals in the case of a breach of security involving such information,
Do Not Track Me Online Act of 2015 (S 2404) Bill that would require companies to allow consumers to stop collection of personal information.
Cyber Intelligence Sharing and Protection Act (CISPA) A proposed law in the United States which would allow for the sharing of Internet traffic information between the U.S. government and technology and manufacturing companies. It would dictate how companies share information about cyberthreats with the federal government. Opponents of the legislation, such as the EFF, do not believe there are adequate privacy protections in the act.
Email Privacy Act of 2016 Amends the Electronic Communications Privacy Act of 1986 to prohibit a provider of remote computing service or electronic communication service to the public from knowingly divulging to any governmental entity the contents of any communication that is in electronic storage or otherwise maintained by the provider Currently, this ECPA reform bill is pending in front of the Senate.