What is the most comparable American law to GDPR right to subject access? Privacy Act? HIPAA seems comparable but only applies to medical data, but is there anything more general than that? How does privacy act compare to data subject access rights under gdpr? Is it that it only applies to government entities but not private sector data controllers?
HIPAA seems comparable but only applies to medical data, but is there anything more general than that? Not really, at least at the national level. There is no comprehensive national regulation of data privacy in the United States. There are regulations related to health information (HIPAA), to educational records, to tax information, to census information, credit reporting agencies, and to banking records (as well, of course, as to national security information). There are also largely consistent restrictions at the state level related to the juvenile justice process. But data privacy is not a subject of general regulation in the U.S. Instead, the data privacy regulations of the U.S. consist of a patchwork of fragmentary state and federal laws and regulations, superimposed on a significant and not entirely consistent or well developed body of common law precedents such as the privacy torts set forth in the Restatement (Second) of Torts, which some states have adopted fully, some states have rejected almost completely, and some states have adopted in part or with significant modifications. The U.S. Constitutional law of the First Amendment also heavily colors how other legal limitations and authorizations are construed and drafted, because the right to distribute truthful information without restriction has long been considered one of the core protections of the First Amendment, even in the much less vigorously protected area of commercial speech. Some states have more general regulations, and the most important of these is California, both because it is a large and economically significant state, and because it is the home to many of the leading U.S. technology companies, many of which expressly adopt of the law of the State of California in choice of law clauses in their terms of service and contracts. The California law most similar to the GDPR is the California Consumer Privacy Act of 2018 (CCPA) which gives consumers rights with respect to the use of the personal information that businesses collect about them and the CCPA regulations that provide guidance on how to implement the law. The website of the State of California's attorney general provides some answers to frequently asked questions about this law.
I'd rather not, but this might be compliant if you make sure that the personal data under your responsibility remains secure and protected even if it is processed abroad. Since the UK has left the EU, it is sometimes necessary to distinguish between implications of the EU GDPR and the UK GDPR. These are functionally equivalent, but in the matter of international data transfers the practical details have diverged. In my answer that you cited, I argued that any website processes personal data, and is thus potentially in-scope for the GDPR. If you cause another organization to process this personal data outside of the UK, you are performing an international data transfer (called “restricted transfer” in UK guidance). For example, such non-UK processing occurs if you use cloud services that run outside of the UK. The UK ICO has guidance on international data transfers. As in an EU GDPR context, you can only perform the transfer if the data remains suitably protected, or one of the exceptions applies. The data remains suitably protected if the target country was attested and “adequate” level of data protection, or if you have implemented appropriate safeguards. As of 2022, the list of countries considered adequate is generally equivalent to the EU list of adequacy decisions. Notably, the US is no longer on that list after the Schrems II decision that invalidated the Privacy Shield Agreement. Since this decision was made before Exit Day, it also applies in the UK. This leaves “appropriate safeguards” for UK→US restricted transfers. In the linked ICO page, read the section Is the restricted transfer covered by appropriate safeguards?. In brief, you will need to perform a Transfer Impact Assessment, and sign Standard Contractual Clauses with the US data importer. In a Transfer Impact Assessment (TIA), you check that the data remains protected despite the transfer into a country without an adequate level of data protection. There is no official guidance on conducting a TIA, but the IAPP has a template and the EU EDPB has recommendations on supplemental measures to protect data transfers, which might reduce the risk and affect a TIA in your favor. It's worth noting that the EDPB recommendations were written in the wake of the Schrems II ruling, and can be summarized as “compliance is impossible when using US-based cloud services”. But this is your assessment, and TBH it seems the UK is a bit more relaxed than the EU in this regard. The Standard Contractual Clauses (SCCs) are a pre-formulated contract that binds the foreign data importer to handle the data properly. In essence, this translates relevant aspects of the UK GDPR into contract law. Many service providers already provide a Data Processing Agreement that includes SCCs by reference, but you'll have to make sure that these contracts have been entered in a legally binding manner. Sometimes these apply automatically as part of the terms of service, sometimes you need to explicitly sign these documents. But SCCs are one detail where UK GDPR compliance and EU GDPR compliance diverges a bit. The old EU SCC templates from 2004/2010 can no longer be used and have been replaced. For compliance with the EU GDPR, the new 2021 SCCs must be used. For compliance with the UK GDPR, you have two options. You can either use the 2022 International Data Transfer Agreement (IDTA), or you can use the 2021 EU SCCs along with the 2022 UK International Data Transfer Addendum which modifies the EU SCCs in some details. Don't want to deal with TIAs and SCCs? Switch to a hosting provider that only processes the personal data under your control in the UK, or in a country with an adequacy decision (e.g. EU, Canada, Israel).
Certainly. A phone number is personal information (and on top of that, WhatsApp may provide some &quot;profile info&quot; from the people you contact). It is not difficult to identify a person by its phone number. So, sharing the phone number of the people affected should take into account the restrictions of GDPR. For instance, the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) established in its Resolution R/03041/2017 that the Town Hall of Boecillo had violated the GDPR because it had created a WhatsApp group of citizens. Those citizens had provided their phone numbers to be informed about town hall activities, but they had not agreed to share their numbers with the other members of the group. And that was a very generic group. Doing a &quot;patients recovering from cancer&quot; or &quot;drug abusers under treatment&quot; or &quot;people who need food assistence&quot; group would involve sharing personal information that gets the maximum protection (in some specific instancies it could be that your information sharing that information is illegal even if the users gave you full consents). So yes, creating a WhatsApp group could very easily lead to a GDPR violation, and in fact it has been ruled at least once that it has. The fact that people cannot send messages is irrelevant. It would not make the issue any better or worse. After all, if I send a message through WhatsApp I am implicitly giving permission to everyone in the group to read it.
It would be legal for a healthcare professional to sign an NDA prohibiting them from revealing certain information to a patient. Some examples: the password to the computer system; the home phone number and address of the chief of staff. It would not be legal to use an NDA as a basis for denying a patient the right to access their medical records when the HIPAA privacy rule mandates disclosure to the patient (with exceptions).
As stated by GDPR article 3 you are required to follow it under the following circumstance: This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union. You can read the recourse better at What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?, but in short the US will allow the EU court to press it's rulings due to wanting to keep its trades, treaties and other similar things in place.
the statute only applies to EU residents Wrong. GDPR applies to everyone in the EU (Art. 3). This means tourists are also covered. Residence status is completely irrelevant (Recital 14(1)): The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence There is no provision for data processors/controllers to demand proof from data subjects of them being located in the EU. You can challenge them, but if they refuse to provide proof you will still be liable to fulfill their GDPR request should they indeed be present in the EU.
Various Privacy Laws may Apply If you live in the EU, the site may be required to delete this information under the GDPR. If you live in the UK, you may have the right to deletion under the UK-GDPR. In each case the procedure for enforcing such a right if the business does not respond depends on the law of your country, and would involve a suit in the courts of that country. Even if a judgement including a court order is obtained, enforcing this on a US firm may not be easy. If you live in California, you may have a right to the deletion of the info under the California Consumer Privacy Act (CCPA) (soon to be replaced by a modified version, the California Privacy Rights Act (CPRA)). If you live in Virginia, you may have rights under the Virginia Consumer Data Protection Act (VCDPA). All these right are subject to various exceptions. Several other states, including Colorado, have passed similar laws, but they have not yet gone into effect. See also &quot;Consumers’ “Right to Delete” under US State Privacy Laws&quot; published by Consumer Privacy World and written by By Glenn A. Brown on March 3, 2021. Since the information was collected (posted) when you were less than 12, your parents may have the right to request deletion under the Federal Children's Online privacy Protection Act (COPPA) The DMCA deals with alleged copyright violations, not with personal privacy issues. CCPA / CPRA The CCPA right to delete applies only to information supplied by the Data Subject (DS). The CCPA right to delete is given by California Civil Code section 1798.105 The Buisness has 10 days to acknowledge a request, and 45 days to respond, which may be extended for an additional 45 days. Note also that the CCPA requires various notices to be delivered to the consumer, and normally requires a privacy policy to be posted. This must include notification of the consumer's rights. Under the CCPA a consumer may not sue a firm directly to enforce the right to delete. Instead a complaint may be made to the California Attorney General, who is empowered to take enforcement action. Only in cases of a data breach ca a consumer sue a firm directly. Note that he CCPA appliws only to firms that: are for-profit businesses that do business in California and Have a gross annual revenue of over $25 million; or Buy, receive, or sell the personal information of 50,000 or more California residents, households, or devices; or Derive 50% or more of their annual revenue from selling California residents’ personal information. See also the official page &quot;California Consumer Privacy Act (CCPA)&quot; VCDPA Section 59.1-573 (A) provides that (A) A consumer may invoke the consumer rights authorized pursuant to this subsection at any time by submitting a request to a controller specifying the consumer rights the consumer wishes to invoke. A known child's parent or legal guardian may invoke such consumer rights on behalf of the child regarding processing personal data belonging to the known child. A controller shall comply with an authenticated consumer request to exercise the right: ... (A) 3. To delete personal data provided by or obtained about the consumer; (A) 4. To obtain a copy of the consumer's personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means; and (A) 5. To opt out of the processing of the personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. Under subsection B the controller (firm) has 45 days to respond, which may be extended for up to an additional 45 days Under 59.1-574 (A) a controller has verious obligations including to: Limit the collection of personal data to what is adequate, relevant, and reasonably necessary ... and to: Not process sensitive data concerning a consumer without obtaining the consumer's consent, or, in the case of the processing of sensitive data concerning a known child, without processing such data in accordance with the federal Children's Online Privacy Protection Act (15 U.S.C. з 6501 et seq.). Under subsectiuon (B) the rights may not be waived by contract. Under subsection (c) the controller must provide: a reasonably accessible, clear, and meaningful privacy notice and this notice must contain: one or more secure and reliable means for consumers to submit a request to exercise their consumer rights under this chapter. Such means shall take into account the ways in which consumers normally interact with the controller, the need for secure and reliable communication of such requests, and the ability of the controller to authenticate the identity of the consumer making the request. Controllers shall not require a consumer to create a new account in order to exercise consumer rights pursuant to з 59.1-573 but may require a consumer to use an existing account. various exemptions are provided for in the VCDPA. As with the CCPA, the previsions may only be enforced by the state Attorney General, not by private lawsuit. The VCDPA only applies to: persons that conduct business in the Commonwealth or produce products or services that are targeted to residents of the Commonwealth and that (i) during a calendar year, control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data. In many ways it is quite similar to the CCPA. COPPA COPPA is a federal law that applies to services, including websites, that collect personal information about children under age 13. It imposes various responsibilities and restrictions on such providers, and give the parents of such children various rights. According to the FTC pagw &quot;Children’s Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business&quot;&quot; Even if parents have agreed that you may collect information from their kids, parents have ongoing rights — and you have continuing obligations. If a parent asks, you must: give them a way to review the personal information collected from their child; give them a way to revoke their consent and refuse the further use or collection of personal information from their child; and delete their child’s personal information. The FTC's FAQ on COPPA states: The primary goal of COPPA is to place parents in control over what information is collected from their young children online. The Rule was designed to protect children under age 13, while accounting for the dynamic nature of the Internet. The Rule applies to operators of commercial websites and online services (including mobile apps and IoT devices, such as smart toys) directed to children under 13 that collect, use, or disclose personal information from children, or on whose behalf such information is collected or maintained (such as when personal information is collected by an ad network to serve targeted advertising). The Rule also applies to operators of general audience websites or online services with actual knowledge that they are collecting, using, or disclosing personal information from children under 13, and to websites or online services that have actual knowledge that they are collecting personal information directly from users of another website or online service directed to children. Operators covered by the Rule must: ... Provide parents access to their child's personal information to review and/or have the information deleted; ... Maintain the confidentiality, security, and integrity of information they collect from children, including by taking reasonable steps to release such information only to parties capable of maintaining its confidentiality and security; Retain personal information collected online from a child for only as long as is necessary to fulfill the purpose for which it was collected and delete the information using reasonable measures to protect against its unauthorized access or use; The same page says that COPPA: applies to operators of commercial websites and online services (including mobile apps and IoT devices) directed to children under 13 that collect, use, or disclose personal information from children. It also applies to operators of general audience websites or online services with actual knowledge that they are collecting, using, or disclosing personal information from children under 13. The Rule also applies to websites or online services that have actual knowledge that they are collecting personal information directly from users of another website or online service directed to children. The FTC, some other federal agencies, and US states may enforce the COPPA Rule.
No, a company cannot suspend your GDPR rights – contracts can't override the law. Your rights as a data subject apply as long as your personal data is being processed. However, there is no requirement in the GDPR that they fulfill your data subject rights through a self-service mechanism like a “download my data” button. They can require you to use another support channel. (But Google offers infamously bad support.) In some cases, the service may legitimately decide that they cannot give you access to the data, for example if they believe that you are not the actual data subject (e.g. if they think that you hacked the account). The right to access must not adversely affect other people (Art 15(4)). If they have doubts about your identity, they can require further information to verify you (Art 12(6)). If your requests are excessive or unfounded (if you are spamming them), they can also turn down the requests (Art 12(5)).