Key Data Protection Regulations

Why This Matters

Data protection regulations aren't just legal fine print—they're the backbone of how businesses ethically collect, store, and use personal information in the digital age. You're being tested on your ability to understand why these regulations exist, how they differ in scope and enforcement, and what rights they grant to individuals. The exam will expect you to distinguish between sector-specific laws (healthcare, finance, education) and comprehensive frameworks (GDPR, CCPA), and to recognize how geographic jurisdiction shapes compliance requirements.

Don't just memorize which law applies where—understand the underlying principles each regulation demonstrates: consent requirements, individual rights, organizational accountability, and enforcement mechanisms. When you can identify what concept a regulation illustrates, you'll be ready for any comparison question or scenario-based prompt the exam throws at you.

---

Comprehensive Privacy Frameworks

These regulations take a broad approach, covering personal data across industries and establishing foundational rights for individuals. They set the standard for what modern data protection looks like.

General Data Protection Regulation (GDPR)

• EU-wide framework—applies to any organization processing data of EU residents, regardless of where the company is located
• Individual rights include access, rectification, erasure ("right to be forgotten"), and data portability
• Penalties reach 4% of annual global turnover or €20 million, whichever is higher—making it one of the most aggressively enforced regulations worldwide

California Consumer Privacy Act (CCPA)

• First major US state-level privacy law—grants California residents rights to know, delete, and opt-out of data sales
• Applies to businesses meeting specific thresholds (annual revenue over $25 million, data on 50,000+ consumers, or 50%+ revenue from selling data)
• Right to opt-out of data sales distinguishes CCPA from GDPR, reflecting concerns about data broker practices

Personal Information Protection and Electronic Documents Act (PIPEDA)

• Canada's federal private-sector privacy law—governs commercial activities across provinces without equivalent legislation
• Consent is foundational—organizations must obtain meaningful consent for collection, use, and disclosure
• Individual access rights allow Canadians to challenge accuracy and request corrections to their personal data

---

Sector-Specific Regulations

Some industries handle particularly sensitive data—health records, financial information, student files. These regulations create heightened protections tailored to specific contexts.

Health Insurance Portability and Accountability Act (HIPAA)

• Protects Protected Health Information (PHI)—covers medical records, billing information, and any health data that identifies an individual
• Requires administrative, physical, and technical safeguards—healthcare providers must implement comprehensive security programs
• Breach notification mandatory—covered entities must notify affected individuals and HHS within specific timeframes

Gramm-Leach-Bliley Act (GLBA)

• Governs financial institutions—banks, securities firms, and insurance companies must protect nonpublic personal information (NPI)
• Privacy notices required—institutions must explain information-sharing practices and give consumers opt-out rights
• Safeguards Rule mandates written security programs with risk assessments and employee training

Family Educational Rights and Privacy Act (FERPA)

• Protects student education records—applies to schools receiving federal funding, from elementary through university
• Parental rights transfer at 18 or when students enter postsecondary education ("eligible students")
• Consent required for disclosure—schools cannot release personally identifiable information without written permission, with limited exceptions

---

Vulnerable Population Protections

Children and minors receive special consideration under privacy law because they cannot meaningfully consent to data practices. These regulations place the burden on organizations to protect those who cannot protect themselves.

Children's Online Privacy Protection Act (COPPA)

• Applies to children under 13—websites and online services directed at children or with actual knowledge of child users must comply
• Verifiable parental consent required—operators must obtain permission before collecting, using, or disclosing children's personal information
• Data minimization principle—cannot condition participation on collecting more data than reasonably necessary for the activity

---

Technical and Operational Standards

Some regulations focus less on individual rights and more on how organizations must handle specific types of data or technologies. These create operational requirements for secure data handling.

Payment Card Industry Data Security Standard (PCI DSS)

• Industry standard, not government law—created by major card brands (Visa, Mastercard, etc.) and enforced through contractual relationships
• 12 core requirements cover network security, encryption, access controls, and regular testing
• Non-compliance consequences include fines, increased transaction fees, and potential loss of ability to process card payments

ePrivacy Directive (Cookie Law)

• Regulates electronic communications in the EU—covers cookies, tracking technologies, and direct marketing
• Prior consent required—websites must obtain user permission before placing non-essential cookies (hence the ubiquitous cookie banners)
• Complements GDPR—while GDPR covers personal data broadly, ePrivacy specifically addresses electronic communications and online tracking

Data Protection Act 2018 (UK)

• UK's post-Brexit GDPR implementation—maintains GDPR principles while allowing UK-specific modifications
• Data Protection Officer (DPO) required for public authorities and organizations conducting large-scale monitoring or processing sensitive data
• 72-hour breach notification to the Information Commissioner's Office (ICO) when breaches risk individual rights

---

Quick Reference Table

---

Self-Check Questions

1. Which two regulations both protect sensitive personal data but apply to different sectors—and what principle do they share regarding organizational safeguards?

2. Compare GDPR's consent model with CCPA's approach: how do they differ, and what does this reveal about EU versus US privacy philosophies?

3. A company operates a children's educational app used in schools. Which regulations might apply, and how would you determine which takes precedence?

4. What distinguishes PCI DSS from government-enacted regulations like GDPR or HIPAA in terms of enforcement mechanisms?

5. If an FRQ describes a multinational company collecting health data from EU residents and processing payments—identify at least three regulations that could apply and explain why each is relevant.