Latest / VoraPrep Audio — Professional Licensure & Certification Exam Prep / [CIPP/US] CIPP1: U.S. Privacy Law Foundations: Sources, Structure, and Authorities
Transcript
- Welcome to VoraPrep Audio. I'm glad you could join me. Let's work through a situation that comes up all the time on the exam, and in the real world. Imagine you're the new privacy officer for a big online store. Things are going great. And then, you get the call. There’s been a data breach. Customer data from all over the country has been exposed. Your legal team turns to you and asks, "Okay, what's our notification plan?" In that moment, you realize it's not about one single federal rule. You have customers in California, Texas, and New York. They all have their own laws. Then you have to consider if customers could sue you directly. And which government agencies are going to start investigating? Today, we're going to clarify this messy, layered world of U.S. privacy law. The first thing to understand is that the U.S. doesn't have one single, comprehensive privacy law like many other countries. It’s more like a patchwork quilt. You have different pieces of fabric, which are different laws, all stitched together. Some laws are for specific industries, like healthcare or finance. Others come from specific states. And some are just old legal principles that have been around for a hundred years. It isn't neat, but you have to know how all the pieces fit together. The foundation of everything is Constitutional law. This is the U.S. Constitution. It never actually uses the word "privacy." But courts have found a "zone of privacy" in a few key amendments. The Fourth Amendment, for example, protects you from unreasonable searches and seizures by the government. Think of it this way: the government needs a very good reason, usually a warrant, to look at your emails or phone data. Then you have the Fifth and Fourteenth Amendments. These are about due process. They ensure the government acts fairly and follows the rules when it deals with your life and your information. The key thing to remember here is simple. Constitutional privacy rights almost always protect you from the government, not from private companies. So, that's the foundation. The next layer is Statutory Law. These are the actual laws written and passed by Congress or your state legislature. This is where you'll find most of the specific rules tested on the exam. At the federal level, the laws are "sector-specific." This means they only apply to certain types of data or industries. You've probably heard of the big ones. There's HIPPA, the Health Insurance Portability and Accountability Act. That's for your health information. If it's your money, like bank accounts or loans, that's governed by GLBA, the Gramm-Leach-Bliley Act. For your credit report, you have the FCRA, the Fair Credit Reporting Act. When we're talking about kids online, specifically kids under 13, that’s COPPA, the Children's Online Privacy Protection Act. And for student records, there’s FERPA, the Family Educational Rights and Privacy Act. It's an alphabet soup, I know. But for the exam, you just need to connect the acronym to the industry it protects. Next, you have state laws. This is where it gets even more complex, because every state can create its own rules. Some states, like California with its CCPA and CPRA, have passed their own large, comprehensive privacy laws. And critically, all 50 states have their own data breach notification laws. This is why our e-commerce company from the example is in such a tough spot. They have to figure out the notification rules for every single state where they have customers. Now, what if there isn't a specific statute that covers a situation? That's where our third source comes in: Common Law. This is judge-made law. It’s not written down by politicians. Instead, it's built up over time through court decisions. In privacy, this usually involves torts. A tort is simply a civil wrong that causes someone harm. There are four classic privacy torts. The first is Intrusion Upon Seclusion. This is just what it sounds like. Someone intentionally intrudes on your private space in a way that would be highly offensive. Think of a reporter using a telephoto lens to take pictures of you inside your home. The second is Public Disclosure of Private Facts. This happens when someone publicizes information about you that is true, but highly private and not newsworthy. An example would be sharing someone's private medical history without their consent. Third is False Light. This one is a little different. It’s about publishing something that puts you in a false light. It might not be a technical lie, but it creates a very misleading and offensive impression. And the final tort is Appropriation. This is when someone uses your name or picture for their own commercial benefit without your permission. Imagine a company using a celebrity’s photo in an ad without paying them. So, even if a company follows every single statute, an individual could still sue them for one of these torts. The last source of law is probably the most straightforward: Contract Law. This is all about promises. When your company publishes a privacy policy, you’re making a promise to your users. You're telling them how you'll handle their data. If you break that promise, you've breached a contract. That's a big deal, especially because one particular federal agency loves to pursue companies for this. This brings us to the referees—the regulatory authorities who enforce all these rules. The big one you absolutely have to know is the Federal Trade Commission, or the FTC. The FTC's main weapon is Section 5 of the FTC. Act. This section prohibits "unfair and deceptive practices." Let's say your privacy policy claims you have "reasonable security," but you don't even encrypt customer passwords. The FTC would call that a deceptive practice. They have broad authority to investigate companies, issue fines, and force them into settlements called consent decrees. But the FTC isn't the only player. For specific sectors, you have specialist regulators. For HIPPA and health data, enforcement is handled by the Department of Health and Human Services, or HHS. Specifically, it's their Office for Civil Rights. For financial privacy under GLBA, you have the Consumer Financial Protection Bureau, or CFPB. For student records under FERPA, it's an office within the Department of Education. You also have the Federal Communications Commission, the FCC, which handles privacy for telecommunications. And don't forget the states. Every State Attorney General can bring enforcement actions under their own state's laws. Plus, some states like California now have their own dedicated privacy agencies. So, when you face a scenario on the exam, how do you sort through all this? Here's a simple mental framework. First, ask yourself: what kind of data and what industry are we talking about? Is it health data? Financial data? Kids' data? This is your first clue to which federal sectoral laws might apply. Second, figure out the jurisdiction. Where is the company located? Where are the customers? This will tell you which state laws are in play. Think especially about breach notification laws and comprehensive ones like California's. Third, run through the four sources of law. Is there a statute? Could there be a common law tort claim? Did the company break a promise in its own privacy policy? Is the government involved, which would bring in the Constitution? Fourth, based on those laws, identify the regulators. Who is the cop on this beat? Is it the FTC.? A state AG.? A specialist like HHS.? It could be more than one. And the final, crucial step is to check for preemption. This is a spot where people get tripped up. Sometimes, a federal law will completely override, or preempt, any conflicting state law. But often, the federal law just sets a minimum standard—a floor. States are then free to provide stronger protections. A classic example is a data breach. HIPPA might have its own notification rule for a hospital. But that hospital will likely also have to comply with state law. And the state's notification requirements for affected patients might be even more specific. Let's apply this with an example. A social media company has a breach. It affects users all over the country, including in California. Their privacy policy promised "reasonable security," but their encryption was very outdated. Which laws and authorities are most likely involved? The data is general consumer data, not health or financial. The users are nationwide, including in California. So right away, you should be thinking about the FTC and California's laws. The company made a promise about "reasonable security" and broke it. That's a contract issue. It also sounds like a deceptive practice under the FTC. Act. Since California residents were affected, the CCPA and CPRA apply. This means the California Attorney General will be interested. So, the best answer would include the FTC. Act and contract law through the privacy policy. It would also include California's CCPA and CPRA, and the California AG. The Fourth Amendment isn't relevant because it's a private company, not the government. And HIPPA isn't relevant because it's not health data. See how that works? You just systematically connect the facts to the right legal framework. Here's one more quick one. A university starts monitoring students' academic and behavioral data without their consent. Which federal law is most directly on point? We're talking about student education records at a university. That's a direct hit for FERPA, the Family Educational Rights and Privacy Act. And the agency that enforces it isn't the FTC or HHS. It’s a specific office within the Department of Education. Knowing those specific pairings is key. To wrap this all up: U.S. privacy law is a layered system. You have constitutional rights against the government. You have specific federal statutes for industries like healthcare and finance. You also have broader laws in states like California. There are old, judge-made common law torts. And there's contract law, which is all about keeping the promises you make in your privacy policy. For every law, there's a regulator. Know the big ones like the FTC and State Attorneys General. But also know the specialists for HIPPA, GLBA, and FERPA. And always check if a federal law sets a floor or a ceiling for state laws. You’ve got this. Keep up the great work. VoraPrep is a full exam-prep app — lessons, practice questions, and an AI tutor in one place. Get started at Vora Prep dot com.