Critical Data Privacy Laws

Why This Matters

In data journalism, privacy laws aren't just legal fine print—they're the framework that determines what data you can access, how you can use it, and what protections you must extend to the people in your datasets. You're being tested on your ability to navigate these regulations because modern journalism increasingly relies on personal data, from health records to consumer behavior to educational outcomes. Understanding these laws means knowing when you need consent, what rights individuals have over their information, and what penalties exist for violations.

These laws also reveal broader tensions you'll encounter throughout your career: transparency vs. privacy, public interest vs. individual rights, government access vs. civil liberties. Don't just memorize which law covers which sector—know what consent mechanisms each requires, what individual rights each grants, and how enforcement mechanisms differ across jurisdictions. That conceptual understanding will serve you whether you're filing FOIA requests, scraping public databases, or investigating corporate data practices.

---

Comprehensive Privacy Frameworks

These laws establish broad protections across entire jurisdictions, setting the standard for how all personal data must be handled regardless of sector. They create baseline rights that apply to most data processing activities.

General Data Protection Regulation (GDPR)

• Explicit consent required—organizations must obtain clear, affirmative agreement before processing personal data, with no pre-checked boxes or buried terms
• Individual rights include access, rectification, erasure, and portability—the "right to be forgotten" has significant implications for archived journalism
• Penalties reach 4% of global annual turnover or €20 million—whichever is higher, making this the most financially consequential privacy law globally

Data Protection Act (UK)

• Post-Brexit GDPR alignment—maintains equivalent protections while establishing UK-specific enforcement through the Information Commissioner's Office (ICO)
• Data Protection Officer (DPO) required for organizations processing large-scale sensitive data—a role journalists should know exists when requesting information
• Journalism exemption exists for processing personal data when publication is in the public interest—a critical carve-out for investigative work

Personal Information Protection and Electronic Documents Act (PIPEDA)

• Consent-based framework governs private sector data handling across Canada—applies to any organization conducting commercial activity
• "Reasonable person" standard for determining appropriate data practices—more flexible than GDPR's prescriptive requirements
• Cross-border data transfers require equivalent protection—relevant when Canadian data flows to U.S. servers or vice versa

---

U.S. State and Consumer Protection Laws

The United States lacks a comprehensive federal privacy law, creating a patchwork of state-level and sector-specific regulations. California has emerged as the de facto standard-setter for consumer privacy rights.

California Consumer Privacy Act (CCPA)

• Right to know and delete—consumers can demand disclosure of what data businesses collect and request its deletion, creating potential sources for data journalism investigations
• Opt-out of data sales must be offered via a clear "Do Not Sell My Personal Information" link—look for this when investigating company compliance
• Applies to businesses meeting revenue or data thresholds—$50 million+ annual revenue, 50,000+ consumers' data, or 50$

Fair Credit Reporting Act (FCRA)

• Accuracy requirements mandate "reasonable procedures" for credit reporting agencies—a frequent source of investigative stories on credit report errors
• Adverse action notices required when credit reports influence decisions against consumers—creates paper trails journalists can follow
• Dispute rights allow consumers to challenge inaccuracies—the dispute process itself generates records useful for systemic investigations

---

Sector-Specific Protections

These laws carve out heightened protections for particularly sensitive categories of data. The logic: some information—health, education, children's data—requires stricter safeguards than general consumer data.

Health Insurance Portability and Accountability Act (HIPAA)

• Protected Health Information (PHI) includes any individually identifiable health data—covers medical records, billing information, and even appointment schedules
• Covered entities include healthcare providers, insurers, and their business associates—but not fitness apps, employers, or schools unless they meet specific criteria
• Civil penalties range from $100 to$50,000 per violation—with criminal penalties including imprisonment for knowing violations

Family Educational Rights and Privacy Act (FERPA)

• Parental rights transfer to students at age 18 or upon entering postsecondary education—a key distinction when requesting student data
• Directory information exception allows release of names, addresses, and enrollment status without consent—often how journalists access basic student information
• Legitimate educational interest permits internal sharing among school officials—but doesn't extend to media requests

Children's Online Privacy Protection Act (COPPA)

• Parental consent required before collecting data from children under 13—applies to websites and apps "directed at" children or with actual knowledge of child users
• Verifiable parental consent means more than a checkbox—FTC requires "reasonable efforts" like signed forms or credit card verification
• Privacy policy requirements mandate plain-language explanations accessible to parents—violations often surface in FTC enforcement actions worth covering

---

Government and Communications Privacy

These laws regulate how government agencies handle personal data and protect the privacy of electronic communications. They establish the boundaries between state power and individual privacy.

Privacy Act of 1974

• Federal agency records only—governs how executive branch agencies collect, maintain, and disclose personal information about U.S. citizens and permanent residents
• System of Records Notices (SORNs) must be published when agencies create databases containing personal information—these are public and useful for identifying what data exists
• First-party access rights allow individuals to request their own records—distinct from FOIA, which covers records about any topic

Electronic Communications Privacy Act (ECPA)

• Warrant requirement for stored communications—but the law's 180-day rule (older emails had fewer protections) has been largely superseded by court decisions
• Wiretap provisions prohibit real-time interception of communications without authorization—relevant when reporting on surveillance programs
• Third-party doctrine complications—metadata and records held by service providers have historically received less protection than content

---

Quick Reference Table

---

Self-Check Questions

1. Which two laws both require explicit consent before data collection but differ significantly in their penalty structures? What makes one more financially consequential than the other?

2. If you're investigating a school district's handling of student health records, which laws might apply, and how would you determine which entity triggers which regulation?

3. Compare CCPA and GDPR: What rights do they share, and why might a story about a European company's privacy violations carry different weight than one about a California-based company?

4. A source offers you leaked data from a children's educational app. Which laws should you consider before publishing, and what questions would you need to answer about how the data was collected?

5. You're writing about federal surveillance programs and want to understand what databases exist containing personal information. Which law requires agencies to publish notices about such systems, and how does this differ from using FOIA to investigate the same agencies?