USA LAW AND PRACTICE Contributed by: Nancy Libin, David Rice, Spencer Persson, Michael Borgia, Robert Stankey, Kara Trowell and Alexander Sisto, Davis Wright Tremaine LLP
• the Privacy Protection Act requires special showing by law enforcement to gain access to materials held by the press; and • the Foreign Intelligence Surveillance Act establishes special procedures for electronic surveillance of, and obtaining records and information relating to, persons considered to be “agents of a foreign power” in the context of national security investigations. State Statutes In the absence of comprehensive federal priva - cy legislation, states began to enact their own omnibus consumer privacy statutes. States have also enacted laws that protect particular types of sensitive personal information (eg, biometric information) and information in certain industry sectors. State General Privacy Laws 20 US states have enacted broad consumer pri - vacy laws. These laws provide similar consumer rights and data controller and processor obliga - tions. California Consumer Privacy Act (CCPA) The CCPA applies to for-profit entities doing business in California that determine the pur - poses and means of data processing and meet the jurisdictional threshold – ie, that: • annually have revenue of over USD26.625 million; • buy, sell or share the personal information of 100,000 or more California residents; or • derive more than 50% of revenue from selling or sharing California consumers’ personal information. These entities are “businesses”, similar to “con - trollers” under the GDPR. Businesses must do
the following, among other things, subject to exceptions: • disclose how they collect and otherwise pro - cess consumers’ personal information; • comply with consumers’ requests to exercise their rights; • enter into contracts with service providers and contractors (equivalent to “proces - sors” under the GDPR) to define and limit the service provider’s ability to use personal information for purposes other than providing services to the business; • enter into contracts with third parties to/with whom they sell or share personal information; • implement reasonable data security meas - ures; • recognise browser settings indicating a con - sumer’s request to opt out of sales or sharing of personal information; • limit the collection, use and disclosure of personal information to what is necessary for the disclosed purposes; • refrain from selling or “sharing” the personal information of consumers who the business has actual knowledge of being under 16 years of age, unless the parent (if the consumer is under 13 years of age) or consumer (if the consumer is at least 13 but under 16 years of age) consents; and • ensure that the consent consumers provide is freely given, specific, informed and unam - biguous. Under the CCPA, consumers (California resi - dents) have rights to do the following: • confirm that a regulated CCPA business is processing their personal information; • access and obtain a copy of that personal information in a portable format; • correct their inaccurate personal information;
525 CHAMBERS.COM
Powered by FlippingBook