USA Law and Practice Contributed by: Aly Dossa and Marcus Burnside, Chamberlain Hrdlicka
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws Constitutional Foundations The US Constitution does not explicitly guarantee a right to privacy, but courts have recognised certain privacy protections through constitutional interpreta - tion. The Fourth Amendment protects against unrea - sonable searches and seizures, establishing limits on government surveillance and data collection. Various Supreme Court decisions have recognised implicit pri - vacy rights in specific contexts; however, these rights do not apply to non-governmental actions. Statutory Framework The United States lacks a comprehensive federal data privacy law comparable to the Europe’s GDPR. Instead, privacy and data laws operate through a combination of state and federal laws. In this patch - work, the federal laws operate through a domain- specific approach that applies to certain data types being used within certain contexts. Meanwhile, some states have enacted general data privacy laws and additional domain-specific laws, but these state laws often have exemptions for data protected by particu - lar federal laws. While many of these laws are less onerous than GDPR, the fractured approach requires a broader base of knowledge, both from legal and technical perspectives. Federal Laws The following provides a list of the most commonly applicable federal laws that apply to data and privacy. However, it should be appreciated that there are sev - eral, rarely applicable laws (including ones that have never been enforced). • Health Insurance Portability and Accountability Act (HIPAA) – governs the use and disclosure of pro - tected health information by covered entities and their business associates. • Gramm-Leach-Bliley Act (GLBA) – regulates finan - cial institutions’ collection, use and disclosure of consumers’ personal financial information. • Children’s Online Privacy Protection Act (COP - PA) – requires parental consent for collection of personal information from children under 13. An
updated version of COPPA, known as COPPA 2.0, is currently working through Congress and may be passed this year. • Family Educational Rights and Privacy Act (FER - PA) – protects the privacy of student education records. • Fair Credit Reporting Act (FCRA) – regulates the collection, dissemination and use of consumer credit information. • Electronic Communications Privacy Act (ECPA) – governs law enforcement access to electronic communications and associated data. • Video Privacy Protection Act (VPPA) – restricts disclosure of personally identifiable rental records for video materials. • Cable Communications Policy Act – protects sub - scriber privacy for cable television services. • Telephone Consumer Protection Act (TCPA) – restricts telemarketing calls, auto-dialed calls and text messages. • CAN-SPAM Act – establishes requirements for commercial email messages. • Genetic Information Nondiscrimination Act (GINA) – prohibits discrimination based on genetic informa - tion in health insurance and employment. Enforcement of these laws is distributed across dif - ferent federal agencies, and, in some cases, enforce - ment can be deferred to state attorneys general. In addition to the above laws that specifically address data privacy, other federal laws can be used to enforce data collection and use. The most prominent of these laws is The Federal Trade Commission Act that empowers the FTC to bring enforcement actions against unfair or deceptive trade practices, which has become a significant source of privacy regulation through enforcement actions and consent decrees. State-Level Comprehensive Privacy Laws 19 states have enacted comprehensive consumer privacy laws as of early 2026, with more legislation pending. Each state law contains different obliga - tions, exemptions, scope provisions and enforcement mechanisms. Notable examples include: • Texas Data Privacy and Security Act (TDPSA);
545 CHAMBERS.COM
Powered by FlippingBook