Privacy law

Area of law

Privacy law is a set of regulations that govern the collection, storage, and utilization of personal information from healthcare, governments, companies, public or private entities, or individuals. Privacy laws are examined in relation to an individual's entitlement to privacy or their reasonable expectations of privacy. The Universal Declaration of Human Rights asserts that every person possesses the right to privacy. However, the understanding and application of these rights differ among nations and are not consistently uniform. Throughout history, privacy laws have evolved to address emerging challenges, with significant milestones including the Privacy Act of 1974 in the U. S. and the European Union's Data Protection Directive of 1995. Today, international standards like the GDPR set global benchmarks, while sector specific regulations like HIPAA and COPPA complement state level laws in the U. S. In Canada, PIPEDA governs privacy, with recent case law shaping privacy rights. Digital platform challenges underscore the ongoing evolution and compliance complexities in privacy law.

Children's Online Privacy Protection Act: provides data protection requirements for children's information collected by online operators. Communications Act of 1934: includes data protection provisions for common carriers, cable operators, and satellite carriers. Computer Fraud and Abuse Act: prohibits the unauthorized access of protected computers. Consumer Financial Protection Act: regulates unfair, deceptive, or abusive acts in connection with consumer financial products or services. Electronic Communications Privacy Act: prohibits the unauthorized access or interception of electronic communications in storage or transit. Fair Credit Reporting Act: covers the collection and use of data contained in consumer reports. Federal Securities Laws: may require data security controls and data breach reporting responsibilities. Federal Trade Commission Act: prohibits unfair or deceptive acts or practices. Gramm Leach Bliley Act: regulates financial institutions' use of nonpublic personal information. Health Insurance Portability and Accountability Act: regulates health care providers' collection and disclosure of protected health information. Video Privacy Protection Act: provides privacy protections related to video rental and streaming.

The Asia Pacific Economic Cooperation (APEC) introduced a voluntary Privacy Framework in 2004, which all 21 member economies adopted. This framework aims to enhance general information privacy and facilitate the secure transfer of data across borders. It comprises nine Privacy Principles, serving as minimum standards for privacy protection, including measures to prevent harm, provide notice, limit data collection, ensure personal information is used appropriately, offer choice to individuals, maintain data integrity, implement security safeguards, allow access and correction of personal information, and enforce accountability. In 2011, APEC established the APEC Cross Border Privacy Rules System to balance the flow of information and data across borders, which is crucial for fostering trust and confidence in the online marketplace. This system builds upon the APEC Privacy Framework and incorporates four agreed upon rules, which involve self assessment, compliance review, recognition/acceptance, and dispute resolution and enforcement.

Article 8 of the European Convention on Human Rights, established by the Council of Europe in 1950 and applicable across the European continent except for Belarus and Kosovo, safeguards the right to privacy. It asserts that "Everyone has the right to respect for his private and family life, his home and his correspondence." Through extensive case law from the European Court of Human Rights in Strasbourg, privacy has been clearly defined and universally recognized as a fundamental right. Furthermore, the Council of Europe took steps to protect individuals' privacy rights with specific measures. In 1981, it adopted the Convention for the protection of individuals with regard to automatic processing of personal data. Additionally, in 1998, the Council addressed privacy concerns related to the internet by publishing "Draft Guidelines for the protection of individuals with regard to the collection and processing of personal data on the information highway," developed in collaboration with the European Commission. These guidelines were formally adopted in 1999.

The 1995 Data Protection Directive (officially Directive 95/46/EC) acknowledged the authority of National data protection authorities and mandated that all Member States adhere to standardized privacy protection guidelines. These guidelines stipulated that Member States must enact stringent privacy laws consistent with the framework provided by the Directive. Moreover, the Directive specified that non EU countries must implement privacy legislation of equivalent rigor to exchange personal data with EU countries. Additionally, companies in non EU countries wishing to conduct business with EU based companies must adhere to privacy standards at least as strict as those outlined in the Directive. Consequently, the Directive has influenced the development of privacy legislation beyond European borders. The proposed ePrivacy Regulation, intended to replace the Privacy and Electronic Communications Directive 2002, further contributes to EU privacy regulations. On 25 May 2018, the General Data Protection Regulation superseded the Data Protection Directive of 1995. A significant aspect introduced by the General Data Protection Regulation is the recognition of the "right to be forgotten," which mandates that any organization collecting data on individuals must delete the relevant data upon the individual's request. The Regulation drew inspiration from the European Convention on Human Rights mentioned earlier.

The OECD (Organisation for Economic Co operation and Development) initiated privacy guidelines in 1980, setting international standards, and in 2007, proposed cross border cooperation for privacy law enforcement. The UN's International Covenant on Civil and Political Rights, Article 17, protects privacy, echoed in the 2013 UN General Assembly resolution affirming privacy as a fundamental human right in the digital age. The Principles on Personal Data Protection and Privacy for the UN System were declared in 2018.

Article 17 of the International Covenant on Civil and Political Rights of the United Nations in 1966 also protects privacy: "No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks." On December 18, 2013, the United Nations General Assembly adopted resolution 68/167 on the right to privacy in the digital age. The resolution makes reference to the Universal Declaration of Human Rights and reaffirms the fundamental and protected human right of privacy. The Principles on Personal Data Protection and Privacy for the United Nations System were declared on October 11, 2018.

The current state of privacy law in Australia includes Federal and state information privacy legislation, some sector specific privacy legislation at state level, regulation of the media and some criminal sanctions. The current position concerning civil causes of action for invasion of privacy is unclear: some courts have indicated that a tort of invasion of privacy may exist in Australia. However this has not been upheld by the higher courts, which have been content to develop the equitable doctrine of Breach of Confidence to protect privacy, following the example set by the UK. The Privacy Act 1988 aims to protect and regulate an individual's private information. It manages and monitors Australian Government and organisations on how they hold personal information. The Bahamas is also a member of CARICOM, the Caribbean Community.

Belize is currently part of the minority of countries that do not have any official data privacy laws. However, the Freedom of Information Act (2000) currently protects the personal information of the citizens of Belize, but there is no current documentation that distinguishes if this act includes electronic data. On 14 August 2018, Brazil enacted its General Personal Data Protection Law. The bill has 65 articles and has many similarities to the GDPR. The first translation into English of the new data protection law was published by Ronaldo Lemos, a Brazilian lawyer specialized in technology, on that same date. There is a newer version.

In Canada, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) governs the collection, use, and disclosure of personal information in connection with commercial activities and personal information about employees of federal works, undertakings and businesses. It generally does not apply to non commercial organizations or provincial governments. Personal information collected, used and disclosed by the federal government and many crown corporations is governed by the Privacy Act. Many provinces have enacted similar provincial legislation such as the Ontario Freedom of Information and Protection of Privacy Act which applies to public bodies in that province. There remains some debate whether there exists a common law tort for breach of privacy. There have been a number of cases identifying a common law right to privacy but the requirements have not been articulated. In Eastmond v. Canadian Pacific Railway & Privacy Commissioner of Canada Canada's Supreme Court found that CP could collect Eastmond's personal information without his knowledge or consent because it benefited from the exemption in paragraph 7(1)(b) of PIPEDA, which provides that personal information can be collected without consent if "it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement".

Canadian privacy laws also interact with international frameworks, notably the European Union’s General Data Protection Regulation (GDPR). Although PIPEDA shares many similarities with GDPR, there are nuanced differences, particularly in terms of consent and data subject rights. Canadian businesses dealing with international data need to comply with both PIPEDA and GDPR, making compliance a complex but critical task

The digital transformation has brought specific challenges and focus areas for privacy regulation in Canada. The Canadian Anti Spam Legislation (CASL), for example, regulates how businesses can conduct digital marketing and communications, requiring explicit consent for sending commercial electronic messages. This legislation is part of Canada's efforts to protect consumers from spam and related threats while ensuring that businesses conduct their digital marketing responsibly. The rise of digital platforms has also prompted discussions about privacy rights concerning consumer data collected by large tech companies. The Privacy Commissioner of Canada has been active in investigating and regulating how these companies comply with Canadian privacy laws, ensuring they provide transparency to users about data usage and uphold the rights of Canadian citizens

Canadian privacy laws are continually evolving to address new challenges posed by technological advancements and global data flows. Businesses operating in Canada must stay informed about these changes to ensure compliance and protect the personal information of their customers effectively. For detailed guidance and the latest updates on compliance with Canadian privacy laws, businesses and individuals can refer to resources provided by the Office of the Privacy Commissioner of Canada and stay informed about developments in Canadian privacy law through expert analyses and updates.

In 1995, the Computer Processed Personal Information Protection Act was enacted in order to protect personal information processed by computers. The general provision specified the purpose of the law, defined crucial terms, prohibited individuals from waiving certain rights. The National Security Law and the Cybersecurity Law promulgated in 2015 give public security and security departments great powers to collect all kinds of information, forcing individuals to use network services to submit private information for monitoring, and forcing network operators to store user data Within China, unrestricted "technical support" from the security department must be provided. Other laws and regulations related to privacy are as follows:

Article 38. The personal dignity of citizens of the People's Republic of China shall not be violated. It is forbidden to use any method to insult, slander, and falsely accuse citizens. Article 39. The residences of the People's Republic of China should be inviolable. It is prohibited to illegally search or trespass into citizens’ houses. Article 40. The freedom and confidentiality of communications of citizens of the People’s Republic of China are protected by law. Except for the needs of national security or the pursuit of criminal offenses, the public security organs or procuratorial organs shall inspect communications in accordance with the procedures prescribed by law, no organization or individual may infringe on citizens’ freedom of communication and confidentiality for any reason.

Article 1032. Natural persons enjoy the right to privacy. No organization or individual may infringe the privacy rights of others by spying, harassing, divulging, disclosing, etc.

The Supreme People's Court's "Interpretation on Several Issues Concerning the Determination of Liability for Compensation for Mental Damage in Civil Torts" was adopted at the 116th meeting of the Judicial Committee of the Supreme People's Court on February 26, 2001. Article 3 After the death of a natural person, if a close relative of a natural person suffers mental pain due to the following infringements, and the people’s court sues for compensation for mental damage, the people’s court shall accept the case: (2) Illegal disclosure or use of the privacy of the deceased, or infringement of the privacy of the deceased in other ways that violate social public interests or social ethics.

Article 39. No organization or individual may disclose the personal privacy of minors. No organization or individual may conceal or destroy letters, diaries, and e mails of minors, except for the need to investigate crimes. Public security organs or people's procuratorates shall conduct inspections in accordance with the law, or letters, diaries, and e mails of minors who are incapacitated. Diaries and e mails shall be opened and read by their parents or other guardians, and no organization or individual shall open or read them.

An archipelago located in the Pacific, the country of Fiji was founded on 10 October 1970. In its constitution, the people inhabiting the land are granted the right to privacy. The exact workings from the constitution is the following: "Every person has the right to personal privacy, which includes the right to — (a) confidentiality of their personal information; (b) confidentiality of their communications; and (c) respect for their private and family life". Billing information and call information are no exceptions. The only exception to this rule is for the purpose of bringing to light "fraud or bad debt". Under this law, even with the consent of the customer, the disclosure of information is not permitted. Other Privacy laws that have been adopted by this country are those that are meant to protect the collected information, cookies and other privacy related matter of tourist. This is in regards to (but not limited to) information collected during bookings, the use of one technology of another that belongs to said company or through the use of a service of the company, or when making payments. Additionally, as a member of the United Nations, the Fiji is bound by the Universal Declaration of Human Rights which states in article twelve, "No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks".

France adopted a data privacy law in 1978. It applies to public and private organizations and forbids gathering sensitive data about physical persons (including sexuality, ethnicity, and political or religious opinions). The law is administered by the Commission nationale de l'informatique et des libertés (CNIL), a dedicated national administration. Like in Germany, data violations are considered criminal offenses (Art. 84 GPR with Code Pénal, Section 1, Chapitre VI, Art. 226ff. ).

Germany is known to be one of the first countries (in 1970) with the strictest and most detailed data privacy laws in the world. The citizens' right to protection is stated in the Constitution of Germany, in Art. 2 para. 1, and Art. 1 para. 1. The citizens' data of Germany is mainly protected under the Federal Data Protection Act (1977) from corporations, which has been amended the most recently in 2009. This act specifically targets all businesses that collect information for its use. The major regulation protects the data within the private and personal sector, and as a member of the European Union (EU), Germany has additionally ratified its act, convention, and additional protocol with the EU according to the EU Data Protection Directive 95/46 EC. In Germany, there are two kinds of restrictions on a transfer of personal data. Since Germany is part of the EU Member States, the transfer of personal data of its citizens to a nation outside the EEA is always subject to a decent level of data protection in the offshore country. Secondly, according to German data policy rules, any transfer of personal data outside the EEA symbolizes a connection to a third party which requires a reason. That reason may be for emergency reasons, and a provision must be met with consent by the receiver and the subject of the data. Keep in mind that in Germany, data transfers within a group of companies is subject to the same treatment as transfer to third parties if the location is outside the EEA. Specifically, the Federal Data Protection Commission is in charge of regulating the entirety of the enforcement of data privacy regulations for Germany. In addition, Germany is part of the Organisation for Economic Cooperation and Development (OECD). The Federal Data Protection Commission of Germany is a member of the International Conference of Data Protection and Privacy Commissioners, European Data Protection Authorities, the EU Article 29 Working Party, and the Global Privacy Enforcement Network. Like in France, data violations are considered offenses (Art. 84 GPR with § 42 BDSG).

During the military dictatorship era the 57 AK law prohibited taking photos of people without their permission but the law has since been superseded. The 2472/1997 law protects personal data of citizens but consent for taking photos of people is not required as long as they aren't used commercially or are used only for personal archiving ("οικιακή χρήση" / "home use"), for publication in editorial, educational, cultural, scientific or news publications, and for fine art purposes (e. g. street photography which has been uphold as legal by the courts whether done by professional or amateur photographers). However, photographing people or collecting their personal data for commercial (advertising) purposes requires their consent. The law gives photographers the right to commercially use photos of people who have not consented to the use of the images in which they appear if the depicted people have either been paid for the photo session as models (so there is no separation between editorial and commercial models in Greek law) or they have paid the photographer for obtaining the photo (this, for example, gives the right to wedding photographers to advertise their work using their photos of newly wed couples they photographed in a professional capacity). In Greece the right to take photographs and publish them or sell licensing rights over them as fine art or editorial content is protected by the Constitution of Greece (Article 14 and other articles) and free speech laws as well as by case law and legal cases. Photographing the police or children and publishing the photographs in a non commercial capacity is also legal.

In Hong Kong, the law governing the protection of personal data is principally found in the Personal Data (Privacy) Ordinance (Cap. 486) which came into force on 20 December 1996. Various amendments were made to enhance the protection of personal data privacy of individuals through the Personal Data (Privacy) (Amendment) Ordinance 2012. Examples of personal data protected include names, phone numbers, addresses, identity card numbers, photos, medical records and employment records. As Hong Kong remains a common law jurisdiction, judicial cases are also a source of privacy law. The power of enforcement is vested with the Privacy Commissioner (the "Commissioner") for Personal Data. Non compliance with data protection principles set out in the ordinances does not constitute a criminal offense directly. The Commissioner may serve an enforcement notice to direct the data user to remedy the contravention and/or instigate the prosecution action. Contravention of an enforcement notice may result in a fine and imprisonment.

Considering the protection of internet property and online data, the ePrivacy Regulations 2011 protect the communications and higher advanced technical property and data such as social media and the telephone. In relation to international data privacy law that Ireland is involved in, the British–Irish Agreement Act 1999 Section 51 extensively states the relationship between data security between the United Kingdom and Ireland. In addition, Ireland is part of the Council of Europe and the Organisation for Economic Cooperation and Development.

Federal Republic of Nigeria's constitution offers its constituents the right to privacy as well as privacy protection. The following can be found in the constitution pertaining to this: "The privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications is hereby guaranteed and protected". Additionally, as a member of the United Nations, Nigeria is bound by the universal declaration of Human Rights which states in article twelve "No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks". This agency is tasked with the job of preventing cyberattacks and regulating the Nigerian information technology industry. Not only does this country grant the Filipinos the right to privacy, but it also protects its people's right to privacy by attaching consequences to the violation of it thereof. In the year 2012, the Philippines passed the Republic Act No. 10173, also known as the "Data Privacy Act of 2012". This act extended privacy regulations and laws to apply to more than just individual industries. This act also offered protection of data belonging to the people regardless of where it is stored, be it in private spheres or not. In that very same year, the cybercrime prevention law was passed. This law was "intended to protect and safeguard the integrity of computer and communications systems" and prevent them from being misused. Not only does the Philippines have these laws, but it has also set aside agents that are tasked with regulating these privacy rules and due ensure the punishment of the violators. Additionally, with the constitution, previous laws that have been passed but that are in violation of the laws above have been said to be void and nullified. Another way this country has shown their dedication in executing this law is extending it to the government sphere as well. Additionally, as a member of the United Nations, the Philippines is bound by the Universal Declaration of Human Rights which states in article two "No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks". For example, privacy can be protected indirectly through various common law torts: defamation, trespass, nuisance, negligence, and breach of confidence. In February 2002, however, the Singaporean government decided that the common law approach was inadequate for their emerging globalized technological economy. In January 2013, Singapore's Personal Data Protection Act 2012 came into effect in three separate but related phases. The phases continued through July 2014 and dealt with the creation of the Personal Data Protection Commission, the national Do Not Call Registry, and general data protection Rules. The Act's general purpose "is to govern the collection, use and disclosure of personal data by organisations" while acknowledging the individual's right to control their personal data and the organizations' legal needs to collect this data. The Act prohibits transfer of personal data to countries with privacy protection standards that are lower than those outlined in the general data protection rules. The law was then superseded on 24 October 1998 by the Personal Data Act (Sw. Personuppgiftslagen) that implemented the 1995 EU Data Protection Directive.

The Data Protection Act of 2018 is the United Kingdom’s main legislation protecting personal data and how it should be collected, processed, stored and shared. In accordance to this legislature, citizens have rights such as the right to access their personal data, and the right to request their data be deleted under certain circumstances, also known as the "right to be forgotten.” The Act also sets out obligations for organizations that handle personal data, including requirements for transparency in data processing, the implementation of appropriate security measures to protect data, and the need for consent from individuals before processing their data.

The Privacy Act of 1974 is foundational, establishing a code of fair information practices that govern the collection, maintenance, use, and dissemination of information about individuals that is maintained in systems of records by federal agencies. This act allows individuals to review and amend their records, ensuring personal information is handled transparently and responsibly by the government. Enacted in 1996, the Health Insurance Portability and Accountability Act (HIPAA) protects sensitive patient health information from being disclosed without the patient's consent or knowledge. HIPAA sets the standard for protecting sensitive patient data held by health care providers, insurance companies, and their business associates. The Federal Trade Commission plays a crucial role in enforcing federal privacy laws that protect consumer privacy and security, particularly in commercial practices. It oversees the enforcement of laws such as the Fair Credit Reporting Act' which regulates the collection and use of consumer credit information.

Individual states also enact their own privacy laws. The California Consumer Privacy Act is one of the most stringent privacy laws in the U. S. It provides California residents with the right to know about the personal data collected about them, the right to delete personal information held by businesses, and the right to opt out of the sale of their personal information. Businesses must disclose their data collection and sharing practices to consumers and allow consumers to access their data and opt out if they choose. The Act recently expanded existing consumer rights in the state in 2023, providing citizens the right to reduce the collection of data and correct false information.

To be able to intrude on someone's seclusion, the person must have a "legitimate expectation of privacy" in the physical place or personal affairs intruded upon. To be successful, a plaintiff "must show the defendant penetrated some zone of physical or sensory privacy" or "obtained unwanted access to data" in which the plaintiff had "an objectively reasonable expectation of seclusion or solitude in the place, conversation or data source." For example, a delicatessen employee told co workers that she had a staph infection in a private manner. It is up to the courts to decide whether someone that is considered "offensive" is acceptable based on the intentions when it comes to searching for that specific news.

A website may commit a "highly offensive" act by collecting information from website visitors using "duplicitous tactics." A website that violates its own privacy policy does not automatically commit a highly offensive act according to the jury. But the Third Circuit Court of Appeals has held that Viacom's data collection on the Nickelodeon website was highly offensive because the privacy policy may have deceptively caused parents to allow their young children to use Nick. com, thinking it was not collecting their personal information.

Though the right to privacy exists in several regulations, the most effective privacy protections come in the form of constitutional articles of Uzbekistan. Varying aspects of the right to privacy are protected in different ways by different situations.

Vietnam, lacking a general data protection law, relies on Civil Code regulations relating to personal data protection. Specifically, the Code "protects information relating to the private life of a person." The 2006 Law on Information Technology protects personal information, such as name, profession, phone number, and email address, and declares that organizations may only use this information for a "proper purpose". The legislation, however, does not define what qualifies as proper. The 2010 Law on Protection of Consumers' Rights provides further protection for consumer information, but it does not define the scope of that information or create a data protection authority; additionally, it is only applicable in the private sector.