Ani Petrosyan
Research expert for cybersecurity and cybercrime
Online privacy regulations in the United States - statistics & facts
As of July 2023, the United States had several digital privacy regulations, which exist either on state level or covering very specific aspects of digital privacy. Examples include the California Consumer Privacy Act (CCPA) and its amendment, the California Privacy Rights Act (CPRA), the Colorado Privacy Act, the Health Insurance Portability and Accountability Act (HIPAA), and the Children’s Online Privacy Protection Act (COPPA). Currently, the United States still lacks an extensive online privacy law that will regulate every aspect of data privacy nationwide.
The Office for Civil Rights (OCR) of the U.S. Department of Health and Human Services (HHS) manages the law enforcement actions for data privacy in the U.S. healthcare industry. In 2022, OCR imposed 22 fines against healthcare organizations in the United States, the highest number of cases since 2008. In the first half of 2023, the highest HIPAA penalty, 1.25 million U.S. dollars, was imposed on a non-profit health system, Banner Health. The organization encountered a cyber attack in 2016 that resulted in the exposure of sensitive information of approximately three million people. In the latest reported period, the first half of 2023, the overall amount of HIPAA settlements and monetary penalties was 1.98 million U.S. dollars.
Who regulates data privacy in the U.S. tech industry?
Despite the United States not having comprehensive data privacy legislation, there is one federal agency that deals with consumer data protection. The Federal Trade Commission (FTC) is the U.S. government agency that enforces the civil antitrust law and protection of consumer rights. The FTC takes law enforcement actions against companies that violate consumers’ privacy rights. When collecting user data, companies are required to keep it safe, and FTC checks whether they follow these policies.The Children’s Online Privacy Protection Act (COPPA)
In 1998, the United States Congress passed the Children’s Online Privacy Protection Act (COPPA). This law protects children’s online data and controls how websites and other online services handle that data. In 2000, the COPPA rule was enacted, regulating how the law should be implemented. The rule requires websites and online services to get parental consent before collecting the personal information of individuals under the age of 13. The U.S. Federal Trade Commission (FTC) manages the enforcement of the COPPA rule. As of August 2023, the highest fine for violating the Children’s Online Privacy Protection Act (COPPA) was incurred by Fortnite Maker Epic Games in December 2022 and amounted to 520 million U.S. dollars.Health Insurance Portability and Accountability Act (HIPAA)
The healthcare sector is one of the most vulnerable industries regarding data privacy. Healthcare institutions gather a massive amount of highly sensitive data, and if treated improperly, this data might be easily accessible for unauthorized third parties. In 2022, healthcare institutions in the United States reported 707 data breach incidents. This number refers to cases involving the exposure of more than 500 data records. Among the ways healthcare organizations lost sensitive data, hacking was the most common.The Office for Civil Rights (OCR) of the U.S. Department of Health and Human Services (HHS) manages the law enforcement actions for data privacy in the U.S. healthcare industry. In 2022, OCR imposed 22 fines against healthcare organizations in the United States, the highest number of cases since 2008. In the first half of 2023, the highest HIPAA penalty, 1.25 million U.S. dollars, was imposed on a non-profit health system, Banner Health. The organization encountered a cyber attack in 2016 that resulted in the exposure of sensitive information of approximately three million people. In the latest reported period, the first half of 2023, the overall amount of HIPAA settlements and monetary penalties was 1.98 million U.S. dollars.
State level privacy: California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
California was the first U.S. state to develop a state-level privacy law for consumer data privacy protection. Proposed in 2018, the California Consumer Privacy Act (CCPA) was enacted on January 1st, 2020, and amended later that year. The law regulates the business obligations toward Californian consumers regarding data privacy. The latest regulation, the California Privacy Rights Act (CPRA), has been fully operative since January 2023. The second version of the law is more comprehensive in terms of both consumer rights and business obligations. Besides CCPA and CPRA, several other privacy laws are signed in other states with the majority of these regulations becoming effective in 2023.International consumer data transfer
Not having a comprehensive data privacy protection law at a federal level makes the United States incompatible with other regions or countries with stricter data requirements. For instance, U.S. companies operating in Europe have difficulties complying with the General Data Protection Regulation (DGPR) of the European Union. In a 2023 survey, 35 percent of U.S. businesses that transfer data internationally said that privacy regulations add extra costs but found them manageable. Additionally, 17 percent said that regulations are a significant impediment to cross-border business. In May 2023, the Irish data privacy authority, Data Protection Commission (DPC), imposed a 1.2 billion euro fine against Meta Platforms Ireland Limited for transferring users' personal data with insufficient legal basis for data processing to the United States.Who is involved in developing online privacy laws?
In recent years, tech giants, who are usually on the receiving end of data privacy law enforcement, have tried turning the tables by proactively announcing that the tech industry needed more regulations and making moves to come up with suggestions to work on developing privacy laws in cooperation with government entities. While this might be a tempting suggestion for the government that could use the advanced expertise of leading tech companies, this might be a way for tech giants to become even more powerful.Ani Petrosyan
,
Dec 18, 2023
Ani Petrosyan
Research expert for cybersecurity and cybercrime
