# Regulatory Standards — US Federal Privacy Landscape

## Health Sector

### HIPAA — Health Insurance Portability and Accountability Act
- **Pub. L. 104-191** (1996); **HITECH Act, Pub. L. 111-5** (2009)
- **45 CFR Part 160**: General Administrative Requirements
- **45 CFR Part 164, Subpart C**: Security Rule — administrative, physical, and technical safeguards
- **45 CFR Part 164, Subpart D**: Breach Notification Rule — notification within 60 days for breaches affecting 500+ individuals
- **45 CFR Part 164, Subpart E**: Privacy Rule — permitted uses and disclosures of PHI, minimum necessary standard, individual rights
- **HHS OCR Guidance on HIPAA and Cloud Computing** (2016, updated 2022)
- **HHS OCR Right of Access Initiative** (2019-present): enforcement of individual access rights

### 42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records
- Stricter than HIPAA for substance use disorder treatment records
- **CARES Act (2020)** amendments align certain Part 2 requirements closer to HIPAA
- Patient consent required for most disclosures

### FTC Health Breach Notification Rule
- **16 CFR Part 318** — applies to non-HIPAA-covered health apps and devices
- **2023 FTC Policy Statement**: clarified application to health apps, wearables, fertility trackers, mental health apps
- Requires notification to FTC, consumers, and media for breaches of unsecured health data

## Financial Sector

### GLBA — Gramm-Leach-Bliley Act
- **Pub. L. 106-102** (1999)
- **Regulation P (12 CFR 1016)**: Financial Privacy Rule — privacy notices and opt-out rights
- **16 CFR Part 314**: FTC Safeguards Rule — comprehensive security programme
  - 2023 amendments: encryption requirements, MFA, CISO designation, incident response plan, annual penetration testing, access controls
- **Interagency Guidelines Establishing Information Security Standards** (OCC, Fed, FDIC, NCUA)

### FCRA — Fair Credit Reporting Act
- **15 U.S.C. 1681 et seq.** (1970); **FACTA (2003)**
- **Regulation V (12 CFR 1022)**: CFPB implementing regulations
- Permissible purposes for obtaining consumer reports (Section 1681b)
- Consumer dispute rights (Section 1681i)
- Adverse action requirements (Section 1681m)
- Identity theft provisions (Section 1681c-1)

## Children and Education

### COPPA — Children's Online Privacy Protection Act
- **15 U.S.C. 6501-6506** (1998)
- **16 CFR Part 312**: COPPA Rule
- **FTC COPPA FAQ** (updated 2023): guidance on verifiable parental consent methods, persistent identifiers, voice recordings, photographs
- **FTC COPPA Safe Harbor Programmes**: CARU, ESRB, TrustArc, Aristotle, PRIVO

### FERPA — Family Educational Rights and Privacy Act
- **20 U.S.C. 1232g**; **34 CFR Part 99**
- Department of Education guidance on FERPA and school safety (2019)
- FERPA exceptions: directory information, legitimate educational interest, studies, audit/evaluation, health/safety emergency

## Electronic Communications

### ECPA — Electronic Communications Privacy Act
- **18 U.S.C. 2510-2522**: Wiretap Act (Title I)
- **18 U.S.C. 2701-2712**: Stored Communications Act (Title II)
- **18 U.S.C. 3121-3127**: Pen Register Act (Title III)
- **Carpenter v. United States, 585 U.S. ___ (2018)**: Fourth Amendment protects cell-site location information; warrant required

### VPPA — Video Privacy Protection Act
- **18 U.S.C. 2710** (1988)
- Applied to streaming services: courts have found that VPPA covers online video streaming platforms
- Active litigation area with class action exposure for unauthorised disclosure of viewing history

## FTC Enforcement Authority

### FTC Act Section 5
- **15 U.S.C. 45(a)**: Prohibition on unfair or deceptive acts or practices
- **FTC Policy Statement on Unfairness** (1980, codified in 1994 amendments): three-part test — substantial injury, not reasonably avoidable, not outweighed by benefits
- **FTC Policy Statement on Deception** (1983): material representation likely to mislead reasonable consumer

### Key FTC Privacy Enforcement Precedents
- **In re Facebook (Meta), 2019**: USD 5 billion settlement for privacy violations (largest FTC privacy penalty)
- **In re Fortnite (Epic Games), 2022**: USD 520 million for COPPA violations and dark patterns
- **In re BetterHelp, 2023**: USD 7.8 million for sharing health data with advertising platforms
- **In re X-Mode Social (Outlogic), 2024**: first FTC action restricting use and sale of sensitive location data
- **FTC Commercial Surveillance and Data Security ANPR** (2022): exploring comprehensive FTC rulemaking

## Executive Orders and White House Initiatives

### Executive Order 14110 on Safe, Secure, and Trustworthy AI (October 2023)
- Directs agencies to develop AI privacy standards
- Requires assessment of AI-related privacy risks in federal procurement
- Calls for OMB guidance on federal agency use of commercially available personal data

### White House Blueprint for an AI Bill of Rights (October 2022)
- Non-binding framework including data privacy principle
- Recommends protection from abusive data practices and individual agency over data use