User:Travism121212/Privacy law - Group D

Privacy law is a set of regulations that govern the collection, storage, and utilization of personal information from healthcare, governments, companies, public or private entities, or individuals.

Privacy laws are examined in relation to an individual's entitlement to privacy or their reasonable expectations of privacy. The Universal Declaration of Human Rights asserts that every person possesses the right to privacy. However, the understanding and application of these rights differ among nations and are not consistently uniform.

Throughout history, privacy laws have evolved to address emerging challenges, with significant milestones including the Privacy Act of 1974 in the U.S. and the European Union's Data Protection Directive of 1995. Today, international standards like the GDPR set global benchmarks, while sector-specific regulations like HIPAA and COPPA complement state-level laws in the U.S. In Canada, PIPEDA governs privacy, with recent case law shaping privacy rights. Digital platform challenges underscore the ongoing evolution and compliance complexities in privacy law.

History

Throughout history, various civilizations recognized the importance of personal space and confidentiality in different ways. Ancient cultures often valued privacy within familial or communal settings, but formal legal protections were lacking. Instead, customs, social norms, and religious beliefs often dictated boundaries around personal information and spaces.

Common law systems, particularly in England, laid the foundation for privacy laws by recognizing certain torts (civil wrongs) related to privacy. For example, trespass laws protected against physical intrusions onto someone's property, while defamation laws addressed harm caused by false statements about a person. A variety of confidence laws emerged and developed to protect sensitive information shared by confidential relationships.

In their groundbreaking 1890 article, Samuel Warren and Louis Brandeis argued for a legal framework to protect individuals from invasive media practices and unauthorized use of their images. They proposed a "right to privacy" based on principles of individual autonomy, dignity, and control over personal information. This article helped shape the modern concept of privacy as a legal right.

Privacy Act of 1974 represented by Seal of the United States Department of Justice

During the mid-20th century witnessed growing concerns about government surveillance and data collection, particularly in the aftermath of World War II and during the Cold War era. In response, countries like the United States enacted laws such as the Privacy Act of 1974 to regulate the government's handling of personal information. These laws aimed to balance national security interests with individual privacy rights.

The European Union's Data Protection Directive of 1995 represented a significant milestone in privacy regulation. It established comprehensive standards for the processing and protection of personal data within EU member states. The directive laid the foundation for subsequent privacy laws in Europe, including the General Data Protection Regulation (GDPR), which became enforceable in 2018 and set a global standard for data protection.

In the United States, privacy laws have evolved through a combination of federal and state legislation, as well as judicial interpretations. Laws such as HIPAA and COPPA address specific privacy concerns related to healthcare information and children's online activities, respectively. However, the U.S. lacks a comprehensive federal privacy law, leading to a patchwork of regulations at the state and sectoral levels.

The rise of the internet, digital technologies, and globalized data flows has presented new challenges for privacy regulation. Concerns about data breaches, online tracking, surveillance, and the monetization of personal information have prompted governments worldwide to reassess and update their privacy laws. International cooperation and coordination are increasingly important to address these challenges effectively.

Emerging technologies such as AI, biometrics, and IoT devices are reshaping the privacy landscape and presenting new regulatory challenges. These technologies raise questions about consent, data transparency, algorithmic bias, and the protection of sensitive personal information. Policymakers, regulators, and stakeholders face the ongoing task of adapting privacy laws to keep pace with technological advancements and protect individuals' privacy rights in the digital age.

Classification of privacy laws

Privacy Laws are broadly classified into 4 different categories:

• Privacy
• Trespassing
• Negligence
• Fiduciary

The categorization of different laws involving individual rights of privacy assesses how different laws protect individuals from being having their rights of privacy violated or abused by certain groups or persons. These classifications provide a framework for understanding the legal principles and obligations that check privacy protection and enforcement efforts and for policymakers, legal practitioners, and individuals to better understand the complexity of the responsibilities involved in order to ensure the protection of privacy rights.

Brief overview of the 4 classifications of each category to understand the ways in which privacy rights are protected and regulated:

Privacy Laws focus on protecting individuals’ rights to control their personal information and prevent unauthorized intrusion into their private lives. They encompass strict regulations governing data protection, confidentiality, surveillance, and the use of personal information by both government and corporate entities.

Trespassing Laws focus on breaches of privacy rights related to physical intrusion onto an individual's property or personal domain without consent. This involves illegal activities such as: entering an individual’s residence without consent, conducting surveillance using physical methods (e.g., deploying hidden cameras), or any unauthorized entry onto the individual’s property.

Negligence laws generally address situations where individuals or entities fail to exercise appropriate caution in protecting the privacy rights of others, often holding them accountable through severe penalties like heavy fines. This aims to ensure compliance and deter future violations, involving incidents such as any mishandling of sensitive data, poor security measures leading to data breaches, or any non-compliance with privacy policies and regulations.

Fiduciary laws regulate the relationships characterized by trust and confidence, where the fiduciary accepts and complies with the legal responsibility for duties of care, loyalty, good faith, confidentiality, and more when entrusted in serving the best interests of a beneficiary. In terms of privacy, fiduciary obligations may extend to professionals like lawyers, doctors, financial advisors, and others responsible for handling confidential information, as a result of a duty of confidentiality to their clients or patients.

International legal standards on privacy

APEC Privacy Framework and Cross Border Privacy Rules System

Countries that include the Asian Pacific Economic Cooperation (APEC)

APEC introduced a voluntary Privacy Framework in 2004, which all 21 member economies adopted. This framework aims to enhance general information privacy and facilitate the secure transfer of data across borders. It comprises nine Privacy Principles, serving as minimum standards for privacy protection, including measures to prevent harm, provide notice, limit data collection, ensure personal information is used appropriately, offer choice to individuals, maintain data integrity, implement security safeguards, allow access and correction of personal information, and enforce accountability.

In 2011, APEC established the APEC Cross Border Privacy Rules System to balance the flow of information and data across borders, which is crucial for fostering trust and confidence in the online marketplace. This system builds upon the APEC Privacy Framework and incorporates four agreed-upon rules, which involve self-assessment, compliance review, recognition/acceptance, and dispute resolution and enforcement.

European Legal Framework for Privacy Protection

Article 8 of the European Convention on Human Rights, established by the Council of Europe in 1950 and applicable across the European continent except for Belarus and Kosovo, safeguards the right to privacy. It asserts that "Everyone has the right to respect for his private and family life, his home and his correspondence." Through extensive case law from the European Court of Human Rights in Strasbourg, privacy has been clearly defined and universally recognized as a fundamental right.

Furthermore, the Council of Europe took steps to protect individuals' privacy rights with specific measures. In 1981, it adopted the Convention for the protection of individuals with regard to automatic processing of personal data. Additionally, in 1998, the Council addressed privacy concerns related to the internet by publishing "Draft Guidelines for the protection of individuals with regard to the collection and processing of personal data on the information highway," developed in collaboration with the European Commission. These guidelines were formally adopted in 1999.

EU Data Protection Directives and GDPR

The 1995 Data Protection Directive (officially Directive 95/46/EC) acknowledged the authority of National data protection authorities and mandated that all Member States adhere to standardized privacy protection guidelines. These guidelines stipulated that Member States must enact stringent privacy laws consistent with the framework provided by the Directive. Moreover, the Directive specified that non-EU countries must implement privacy legislation of equivalent rigor to exchange personal data with EU countries. Additionally, companies in non-EU countries wishing to conduct business with EU-based companies must adhere to privacy standards at least as strict as those outlined in the Directive. Consequently, the Directive has influenced the development of privacy legislation beyond European borders. The proposed ePrivacy Regulation, intended to replace the Privacy and Electronic Communications Directive 2002, further contributes to EU privacy regulations.

On 25 May 2018, the General Data Protection Regulation superseded the Data Protection Directive of 1995. A significant aspect introduced by the General Data Protection Regulation is the recognition of the "right to be forgotten," which mandates that any organization collecting data on individuals must delete the relevant data upon the individual's request. The Regulation drew inspiration from the European Convention on Human Rights mentioned earlier.

OECD Guidelines and UN Declarations

Countries that are included in the Organisation for Economic Co-operation and Development (OECD)

The OECD (Organisation for Economic Co-operation and Development) initiated privacy guidelines in 1980, setting international standards, and in 2007, proposed cross-border cooperation for privacy law enforcement. The UN's International Covenant on Civil and Political Rights, Article 17, protects privacy, echoed in the 2013 UN General Assembly resolution affirming privacy as a fundamental human right in the digital age. The Principles on Personal Data Protection and Privacy for the UN System were declared in 2018.

Privacy laws in the United States

United States

The privacy framework of the United States is characterized by its sectoral approach, with a combination of federal and state laws tailored to address privacy concerns in specific areas of economic and social activity. Unlike some jurisdictions that have a single overarching privacy law, the U.S. system comprises a variety of laws and regulations, each designed to protect personal information in contexts ranging from healthcare and finance to education and online activities.

Federal Privacy Laws

The Privacy Act of 1974 is foundational, establishing a code of fair information practices that govern the collection, maintenance, use, and dissemination of information about individuals that is maintained in systems of records by federal agencies. This act allows individuals to review and amend their records, ensuring personal information is handled transparently and responsibly by the government.(Justice)

Enacted in 1996, the Health Insurance Portability and Accountability Act (HIPAA) protects sensitive patient health information from being disclosed without the patient's consent or knowledge. HIPAA sets the standard for protecting sensitive patient data held by health care providers, insurance companies, and their business associates.​

The Federal Trade Commission| (FTC) plays a crucial role in enforcing federal privacy laws that protect consumer privacy and security, particularly in commercial practices. It oversees the enforcement of laws such as the Fair Credit Reporting Act which regulates the collection and use of consumer credit information.​

Specific protections for the privacy of children online and students' education records are provided by the Children's Online Privacy Protection Act (COPPA) and the Family Educational Rights and Privacy Act (FERPA), respectively. ​

State Privacy Laws

Individual states also enact their own privacy laws. The California Consumer Privacy Act (CCPA) is one of the most stringent privacy laws in the U.S. It provides California residents with the right to know about the personal data collected about them, the right to delete personal information held by businesses, and the right to opt-out of the sale of their personal information. Businesses must disclose their data collection and sharing practices to consumers and allow consumers to access their data and opt-out if they choose. ​

Enforcement and Impact

Enforcement of these laws is specific to the statutes and the authorities responsible. For instance, HIPAA violations can lead to substantial fines imposed by the Department of Health and Human Services, while the FTC handles penalties under consumer protection laws. State laws are enforced by respective state attorneys general or designated state agencies.​

The privacy laws in the U.S. reflect a complex landscape shaped by sector-specific requirements and state-level variations, illustrating the challenge of protecting privacy in a federated system of government.

Privacy Laws in Canada

Implications for Specific Sectors

Parliament of Canada building

Canadian privacy laws have significant implications for various sectors, particularly finance, healthcare, and digital commerce. For instance, the financial sector is strictly regulated under PIPEDA, which requires financial institutions to obtain consent for the collection, use, or disclosure of personal information. Moreover, these institutions must also provide robust safeguards to protect this information against loss or theft.

In healthcare, provinces like Alberta and British Columbia have specific laws protecting personal health information, which require healthcare providers to manage patient data with high confidentiality and security levels. This includes ensuring that patient consent is obtained before their personal health information is shared or accessed

Case Law and Regulatory Actions

Recent case law in Canada has further defined the scope and application of privacy laws. For instance, the case of Jones v. Tsige recognized the tort of intrusion upon seclusion, affirming that individuals have a right to privacy against unreasonable intrusion. This landmark ruling has significant implications for how personal data is handled across all sectors, emphasizing the need for businesses to maintain strict privacy controls.

Interaction with International Privacy Frameworks

Canadian privacy laws also interact with international frameworks, notably the European Union’s General Data Protection Regulation (GDPR). Although PIPEDA shares many similarities with GDPR, there are nuanced differences, particularly in terms of consent and data subject rights. Canadian businesses dealing with international data need to comply with both PIPEDA and GDPR, making compliance a complex but critical task

Privacy Rights and Obligations in Digital Platforms

The digital transformation has brought specific challenges and focus areas for privacy regulation in Canada. The Canadian Anti-Spam Legislation (CASL), for example, regulates how businesses can conduct digital marketing and communications, requiring explicit consent for sending commercial electronic messages. This legislation is part of Canada's efforts to protect consumers from spam and related threats while ensuring that businesses conduct their digital marketing responsibly. ​

The rise of digital platforms has also prompted discussions about privacy rights concerning consumer data collected by large tech companies. The Privacy Commissioner of Canada has been active in investigating and regulating how these companies comply with Canadian privacy laws, ensuring they provide transparency to users about data usage and uphold the rights of Canadian citizens​

Future Directions and Compliance Challenges

Canadian privacy laws are continually evolving to address new challenges posed by technological advancements and global data flows. Businesses operating in Canada must stay informed about these changes to ensure compliance and protect the personal information of their customers effectively.

For detailed guidance and the latest updates on compliance with Canadian privacy laws, businesses and individuals can refer to resources provided by the Office of the Privacy Commissioner of Canada and stay informed about developments in Canadian privacy law through expert analyses and updates.

Privacy Laws in the United Kingdom

Data Protection Act of 2018

Privacy law in the United Kingdom is primarily revolves around the Data Protection Act of 2018, which is the UK’s main legislation protecting personal data and how it should be collected, processed, stored and shared. In accordance to this legislature, citizens have rights such as the right to access their personal data, and the right to request their data be deleted under certain circumstances, also known as the "right to be forgotten.” The Act also sets out obligations for organizations that handle personal data, including requirements for transparency in data processing, the implementation of appropriate security measures to protect data, and the need for consent from individuals before processing their data.

Privacy and Electronic Communications Regulations

The Privacy and Electronic Communications Regulations, established in 2003, gave citizens control in consent and disclosure of information in specific electronic communications including:

• marketing calls, emails, texts and faxes
• cookies and tracking technologies
• secure communications
• customer privacy as regards traffic and location data, billing, phone line identification, and directory listings.

The goal of the Privacy and Electronic Communications Regulations is to protect individuals’ privacy and control over their electronic communications while promoting responsible and transparent practices by organizations that engage in electronic marketing and in the use of tracking technologies.

United Kingdom General Data Protection Regulation

The United Kingdom General Data Protection Regulation, is the domestic version of the European Union's General Data Protection Regulation (GDPR), implemented into UK law through the Data Protection Act 2018 and came into effect alongside the EU GDPR in May 2018.

UK GDPR governs data protection and privacy within the UK applying to the processing of personal data by organizations operating within the UK. It includes specific provisions tailored to the UK's legal framework and requirements.

Key aspects of the UK GDPR include:

• Data Protection - Establishes principles for the processing of citizen's personal data under the compliance of confidentiality, integrity and availability standards.
• Data Breach Notifications - Requires organizations operating within the UK to disclose any and all information regarding recent breaches to the authorities and notify all parties impacted by the breach.
• Rights of Data Accessibility - Citizens have the right to access, modify, restrict and delete personal data collected by organizations.
• Legal Basis for Data Processing - Organizations must comply with the legal obligations when processing personal data.
• Accountability and Compliance - Organizations are required to demonstrate compliance with data protection including the implementation of security measures to protect data and to conduct Data Protection Impact Assessments while maintaining records or processing activities.

The UK GDPR aims to ensure that personal data is processed legally, fairly and with full transparency while individuals are given control over the handling of their personal data.

For more information about the Privacy Laws in the United Kingdom:

For detailed guidance and the latest updates on compliance with United Kingdom privacy laws, businesses and individuals can refer to resources provided by the https://ico.org.uk/ and stay informed about developments in UK privacy law through expert analyses and updates.

Privacy Law in the European Union

General Data Protection Regulation

The General Data Protection Regulation applies uniformly to all members of the European Union, ensuring a basic and consistent standard of data protection within all member states. Each European Union state is responsible for enforcing the GDPR within their respective territories. Certain EU states may introduce additional laws and regulations in supplement to the core principles of the GDPR.

Fundamental rules of GDPR includes:

• The right to access all data involved in the collection and processing.
• The right for the data to be corrected.
• The right for all data to be erased when requested.
• The right to restrict further processing and collection of data.

Principles of Data Protection

1. Lawfulness, fairness and transparency — Data Processing must be lawful, fair, and transparent to the data subject.
2. Purpose limitation — Data is collected for the legitimate purposes specified explicitly to the data subject when collected.
3. Data minimization — Data is only to be collected and processed only in the necessary amount.
4. Accuracy — Personal data must be up to date.
5. Storage limitation — Personally identifying data is stored for as long as necessary for the specified purpose.
6. Integrity and confidentiality — Processing must be in compliance to proper standards of security, integrity, and confidentiality.
7. Accountability — Organizations are responsible for their compliance with the principles of GDPR.

Legalities of Data Processing

Legal processing of data including collecting, storing and selling is allowed only if:

1. The individual gave consent to process the data usually by accepting the terms of a service.
2. The processing is necessary to enter into a contract involving the individual whose data is collected.
3. In compliance with a legal obligation such as a court order.
4. You need to process the data for a serious investigation.
5. The processing is required to perform a task in service of the public

The GDPR compliance applies to organizations within and outside of the EU that offers good or services.

European Union States affected by the GDPR:

• Austria
• Belgium
• Bulgaria
• Croatia
• Cyprus
• Czech Republic
• Denmark
• Estonia
• Finland
• France

• Germany
• Greece
• Hungary
• Ireland
• Italy
• Latvia
• Lithuania
• Luxembourg
• Malta
• The Netherlands

• Poland
• Portugal
• Romania
• Slovakia
• Slovenia
• Spain
• Sweden
• United Kingdom

References

1. Belkhamza, Zakariya. 2017. “The Effect of Privacy Concerns on Smartphone App Purchase in Malaysia: Extending the Theory of Planned Behavior.” International Journal of Interactive Mobile Technologies 11(5):178-194.
2. Bhasin, Madan Lal. 2016. “Challenge of guarding online privacy: role of privacy seals, government regulations and technological solutions.” Socio-Economic Problems & the State 15(2):85-104.
3. Bignami, Francesa. 2011. “Cooperative Legalism and the Non-Americanization of European Regulatory Styles: The Case of Data Privacy.” The American Journal of Comparative Law 59(2):411-461.
4. Butt, Lesli. 2011. “Can you keep a secret? Pretences of confidentiality in HIV/AIDS counseling and treatment in eastern Indonesia.” Medical Anthropology 30(3):319-338.
5. Chandran, Ravi. 2000. “Privacy in Employment.” Singapore Journal of Legal Studies 2000(1):263-297.
6. Chesterman, Simon. 2012. “After Privacy: The Rise of Facebook, the Fall of WikiLeaks, and Singapore’s ‘Personal Data Protection Act 2012.’” Singapore Journal of Legal Studies 391-415.
7. Chik, Warren B. 2013. “The Singapore Personal Data Protection Act and an assessment of future trends in data privacy reform.” Computer Law & Security Review: The International Journal of Technology Law and Practice 29(5):554-575.
8. Dove, Edward S. 2015. “Biobanks, Data Sharing, and the Drive for a Global Privacy Governance Framework.” Journal of Law, Medicine & Ethics 43(4):675-689.
9. Greenleaf, Graham. 2009. “Five years of the APEC Privacy Framework: Failure or promise?” Computer Law and Security Review: The International Journal of Technology and Practice 25(1):28-43.
10. Greenleaf, Graham. 2012. “Independence of data privacy authorities (Part 1): International standards.” Computer Law & Security Review 28(1):3-13.
11. Hew, Khe Foon, and Wing Sum Cheung. 2012. “Use of Facebook: A Case Study of Singapore Students’ Experience.” Asia Pacific Journal of Education 32(2):181-196.
12. Llanillo, Llewellyn L., and Khersien Y. Bautista. 2017. “Zones of Privacy: How Private?” Defense Counsel Journal 1-27.
13. Marvin, Lynn M. and Yohance Bowden. 2015. “Conducting U.S. Discovery in Asia: An Overview of E- Discovery and Asian Data Privacy Laws.” Richmond Journal of Law & Technology 21(4):1-55.
14. Mehta, Michael D. 2002. “Censoring Cyberspace.” Asian Journal of Social Sciences 30(2):319-338.
15. Mitsilegas, Valsamis. 2016. “Surveillance and Digital Privacy in the Transatlantic “War on Terror”: The Case for a Global Privacy Regime.” Columbia Human Rights Law Review 47(3):1-77.
16. Peng, Shin-Yi. 2003. “Privacy and the Construction of Legal Meaning in Taiwan.” The International Lawyer 37(4):1037-1054.
17. Tene, Omer. 2013. “Privacy Law’s Midlife Crisis: A Critical Assessment of the Second Wave of Global Privacy Laws.” Ohio State Law Journal 74(6):1217-1261.
18. Thomas, Mathews. 2004. “Is Malaysia’s MyKad the ‘one card to rule them all’? The urgent need to develop a proper legal framework for the protection of personal information in Malaysia.” Melbourne University Law Review 1-38.
19. Ramasoota, Pirongrong and Sopak Panichpapiboon. 2014. “Online Privacy in Thailand: Public and Strategic Awareness.” Journal of Law, Information & Science 23(1):97-136.
20. Reidenberg, Joel R. 2000. “Resolving Conflicting International Data Privacy Rules in Cyberspace.” Stanford Law Review 52(5):1315-1371.
21. Federal Trade Commission. "Protecting Consumer Privacy and Security". Retrieved April 24, 2024.
22. California Office of the Attorney General. "California Consumer Privacy Act (CCPA)". Retrieved April 24, 2024.
23. U.S. Department of Justice. "Overview of the Privacy Act of 1974 - 2020 Edition". Retrieved April 24, 2024.
24. Library of Parliament (Canada). "Privacy Law in Canada". Retrieved April 24, 2024.
25. DataGuidance. "Canada - Data Protection Overview". Retrieved April 24, 2024.
26. Office of the Privacy Commissioner of Canada. "Privacy Laws in Canada". Retrieved April 24, 2024.
27. HealthIT.gov. "Health Information Privacy Law and Policy". Retrieved April 24, 2024.
28. Columbia Global Freedom of Expression. "Jones v. Tsige". Retrieved April 24, 2024.
29. Government of Canada. "Canada Anti-Spam Legislation". Retrieved April 24, 2024.
30. Warren and Brandeis (15 December 1890). "The Right to Privacy". Harvard Law Review. IV (5): 193–220. doi:10.2307/1321160. JSTOR 1321160.