USA Law and Practice Contributed by: Aly Dossa and Marcus Burnside, Chamberlain Hrdlicka
1.2 Rights and Obligations General Principles for Processing Personal Data As discussed in 1.1 Overview of Data and Privacy- Related Laws , US privacy laws operate through a complex patchwork that have been enacted across decades and meant to accomplish divergent goals. Despite this complexity, a common theme through - out most US privacy laws is that organisations should provide clarity. As such, there is very limited ability to provide generally applicable guidance on rights and obligations for personal data. Instead, the follow - ing serves as a framework for the practical steps of achieving compliance with US privacy laws. Practical Implementation Checklist Organisations should approach compliance in phases. • Assessment phase – determine applicable laws, conduct gap analysis, identify high-risk activities and prioritise based on legal risk and enforcement patterns. • Foundation phase – create data inventory, map data flows, inventory systems and vendors, and establish data governance. • Operational phase – draft policies, implement rights management systems, configure consent mechanisms, execute vendor contracts, deploy security controls and establish training pro - grammes. • Ongoing phase – monitor regulatory developments, conduct periodic compliance reviews, update processes as business changes, and maintain records of requests, assessments and compliance decisions. Critical elements vary by applicable law. Examples of some of the most commonly applicable privacy laws include: • HIPAA requires designated officers, workforce sanctions, Business Associate Agreements and Security Rule safeguards; • COPPA requires age-screening, verifiable parental consent and limited collection; • GLBA requires annual privacy notices, opt-out mechanisms and information security programmes; and
Non-personal data US law focuses primarily on personally identifiable information, with less regulation of anonymised or aggregate data. However, the boundaries are increasingly contested as re-identification techniques improve (ie, using a collection of non-identifying data to identify an individual). State privacy laws vary in how they define personal information and whether they regulate pseudonymised or de-identified data. Trade secret and intellectual property laws may gov - ern certain business data. AI regulation AI-specific privacy regulation is emerging but remains limited. The federal government continues to change and evolve its stance on AI use and regulation but has largely used existing laws and regulations to enforce AI-related use. Colorado has enacted requirements for high-risk AI systems. Several states have proposed AI-specific legislation addressing algorithmic discrimi - nation, automated decision-making, and transparen - cy. Federal sectoral regulators (FTC, EEOC, CFPB) have issued guidance on AI applications within their domains. The interplay typically involves applying existing privacy principles (transparency, fairness, purpose limitation) to AI-driven processing, with questions about whether automated decision-making requires heightened protections. Regulatory enforcement and trends Enforcement authority varies significantly. Federal laws are typically enforced by designated agencies (FTC, HHS, FCC, etc). State comprehensive privacy laws grant enforcement authority to state attorneys general. However, some states provide a limited pri - vate right of action under certain statutes. This creates a multi-regulator environment where various authori - ties may have overlapping jurisdiction. The trend is toward increased state-level activity given federal legislative gridlock; however, both state and federal enforcement has adjusted to view data privacy as a subset of consumer protection. Meanwhile, the plaintiff’s bar continues to use older laws applied to new technologies to drive compliance in highly spe - cific domains or use cases of data.
547 CHAMBERS.COM
Powered by FlippingBook