As consumers become more informed about the use of their personal information, national governments have responded with laws designed to protect individual rights and promote standards for commercial uses of private information. The typical approach is to develop umbrella legislation that applies to a wide range of these uses. In contrast, the United States legislates on these issues with sectoral laws, resulting in a patchwork of privacy and data security requirements. Taken together with the technical considerations included in or added to these provisions, the laws make up the backbone of federal cybersecurity law for the private sector.

This Survey is divided into sectoral areas based on legislative targets.

These sectors include:

• Health
• Education
• Finance
• Marketing
• Media

Laws of general application are included at the end of the Survey. Again, however, these provisions focus on discrete issues: child protection and international data transfers.

Currency and Scope

This Survey was created September 2017, and covers federal statutes and regulations. Cases of interest are also provided.

This Survey omits federal criminal laws on identity theft and other privacy-related crimes, as well as laws specifically binding on the government itself as opposed to private-sector entities. Overarching consumer protection laws, such as the Federal Trade Commission Act, are also excluded. Although the FTC Act bars unfair or deceptive trade practices in general, this Survey’s focus is more detailed use- and sector-specific legislation and regulation.

Stacey Supina, Her professional background includes corporate compliance, business-to-business contracting, and employment and environmental issues. In addition to her work at LRC, Stacey teaches at the University of St. Thomas School of Business. She received her J.D. from the University of Minnesota Law School and her LL.M. from University College London, England, where her thesis concerned packaging waste regulation.