USA Law and Practice Contributed by: Aly Dossa and Marcus Burnside, Chamberlain Hrdlicka
• state comprehensive privacy laws often require “Do Not Sell” links, universal opt-out signal recognition, data protection assessments and authenticated consumer portals in some jurisdictions. Organisations should prioritise compliance efforts based on legal risk (laws with private rights of action or active enforcement), data sensitivity (health, finan - cial, biometric, children’s data), scale of processing, reputational exposure and business criticality, recog - nising that compliance is an ongoing process requir - ing continuous monitoring and adaptation. 1.3 Special Categories of Personal Data Because US federal law addresses special catego - ries of data primarily through sectoral regulation rather than comprehensive frameworks, each category of data governed by a federal law could be considered a special category. Some example statutes are provided in 1.1 Overview of Data and Privacy-Related Laws . At the state level, state comprehensive privacy laws typically classify as “sensitive personal information” requiring enhanced protections: health data, biomet - ric data (with approximately 15 states having specific biometric privacy statutes requiring informed con - sent), genetic information, precise geolocation data, citizenship or immigration status, data revealing racial or ethnic origin, religious beliefs, sexual orientation, social security numbers, financial account credentials, and in some states, union membership or communi - cations content. Processing sensitive data under state laws generally requires either affirmative opt-in consent or at mini - mum providing consumers with the right to opt out of such processing, along with heightened security measures, purpose limitations and more stringent vendor oversight. Several states prohibit processing that results in unlawful discrimination based on pro - tected characteristics and restrict certain automated decision-making using sensitive categories. Data Relating to Minors and Criminal Convictions COPPA applies to operators of websites or online ser - vices directed to children under 13, or operators with actual knowledge they are collecting personal infor - mation from children under 13, requiring operators to
post clear privacy policies, provide direct notice to parents, obtain verifiable parental consent before col - lecting information, honour parental rights to review and delete children’s information, maintain confiden - tiality and security of children’s data, and limit collec - tion to what is reasonably necessary for participation in the activity. Some state laws extend protections beyond age 13, with California’s Age-Appropriate Design Code Act (currently subject to litigation) imposing obligations for likely child users under 18, and several states enacting restrictions on social media platforms’ use of minors’ data for targeted advertising or requiring parental con - sent for minors’ accounts. Regarding criminal conviction data, FCRA restricts consumer reporting agencies from including arrests over seven years old, paid tax liens over seven years old, and most other adverse information over seven years old in consumer reports, while the Equal Employ - ment Opportunity Commission (EEOC) provides guid - ance limiting employers’ use of arrest and conviction records to avoid discriminatory impact under Title VII. State comprehensive privacy laws generally do not create special categories for criminal history data separate from general personal information protec - tions, though state-specific “ban the box” laws, fair chance hiring statutes, and criminal record sealing/ expungement laws limit when and how employers, landlords and others may request, consider or retain criminal history information. 1.4 Processing of Personal Data for Research and Development Purposes Anonymisation for Product Development and Scientific Research The first step is to determine which laws apply to the data. In the US, HIPAA commonly applies to per - sonal health information (PHI), but there are many circumstances under which HIPAA does not apply to PHI, and other laws, including various federal and state laws, may apply. In addition, there are different exemptions for the use of PHI for research purposes under most privacy laws. Further, anonymising or de- identifying can cause PHI to no longer be considered PHI under US laws, and thus the various laws gov -
548 CHAMBERS.COM
Powered by FlippingBook