|
Preface
|
|
PART I
OVERVIEW OF GLOBAL PRIVACY LAW
|
|
Chapter 1
OVERVIEW OF GLOBAL PRIVACY AND DATA SECURITY LAW REGIMES
|
|
§1.01
|
United States Privacy and Data Security Framework
|
|
§1.02
|
European Union Data Protection Framework
|
|
§1.03
|
Other Jurisdictions
|
|
§1.04
|
Data Localization
|
|
§1.05
|
Conclusion
|
|
PART II
U.S. PRIVACY LAW
|
|
Chapter 2
FAIR CREDIT REPORTING ACT
|
|
§2.01
|
Introduction
|
|
§2.02
|
Fair Credit Reporting Act
|
|
§2.03
|
Fair and Accurate Credit Transactions Act
|
|
Chapter 3
FINANCIAL PRIVACY
|
|
§3.01
|
Introduction to Financial Privacy
|
|
§3.02
|
Gramm-Leach-Bliley Act
|
|
§3.03
|
Cybersecurity Issues
|
|
§3.04
|
Social Media in the Financial Sector
|
|
§3.05
|
State Financial Privacy Laws
|
|
§3.06
|
Right to Financial Privacy Act of 1978
|
|
Chapter 4
PRIVACY OF HEALTH INFORMATION
|
|
§4.01
|
Introduction to Privacy of Health Information
|
|
§4.02
|
Health Insurance Portability and Accountability Act of 1996
|
|
§4.03
|
Genetic Information Nondiscrimination Act of 2008
|
|
§4.04
|
State Laws
|
|
Chapter 5
CHILDREN'S AND STUDENTS' PRIVACY
|
|
§5.01
|
Introduction to Children's and Students' Privacy
|
|
§5.02
|
Children's Privacy
|
|
§5.03
|
Student Privacy
|
|
Chapter 6
TELECOMMUNICATIONS AND CABLE PRIVACY
|
|
§6.01
|
Introduction to Telecommunications and Cable Privacy
|
|
§6.02
|
Telecommunications Act of 1996
|
|
§6.03
|
Telephone Records and Privacy Protection Act
|
|
§6.04
|
Cable Subscriber Privacy Rules
|
|
§6.05
|
FCC Broadband Consumer Privacy Rules
|
|
§6.06
|
Telephone Consumer Protection Act and TRACED Act
|
|
Chapter 7
DRIVER'S PRIVACY PROTECTION ACT
|
|
§7.01
|
Introduction to the Driver's Privacy Protection Act
|
|
§7.02
|
Prohibitions and Exceptions
|
|
§7.03
|
Resale and Redisclosure of Personal Information
|
|
§7.04
|
Civil and Criminal Liability
|
|
§7.05
|
State Statutes
|
|
§7.06
|
Case Law
|
|
Chapter 8
PRIVACY OF VIDEO RECORDS
|
|
§8.01
|
Introduction to Privacy of Video Records
|
|
§8.02
|
Limitations on Disclosure
|
|
§8.03
|
Destruction of Personally Identifiable Information
|
|
§8.04
|
Competing Views on Applicability of the Law
|
|
§8.05
|
Personally Identifiable Information
|
|
§8.06
|
“Consumers” Under the VPPA
|
|
§8.07
|
Penalties
|
|
§8.08
|
Relationship of Federal Law to State Law
|
|
Chapter 9
MARKETING AND PRIVACY
|
|
§9.01
|
Introduction to Marketing and Privacy
|
|
§9.02
|
Direct Postal Mail Marketing
|
|
§9.03
|
Email Marketing
|
|
§9.04
|
Telemarketing
|
|
§9.05
|
Mobile Marketing: SMS and MSCMs
|
|
§9.06
|
Facsimile Advertising
|
|
§9.07
|
California's “Shine the Light” Law
|
|
§9.08
|
California's Song-Beverly Credit Card Act of 1971 and Other State Analogs
|
|
§9.09
|
Online Behavioral Advertising
|
|
§9.10
|
Biometric and Geolocation Data
|
|
§9.11
|
Privacy Seal Programs
|
|
§9.12
|
Political Advertising
|
|
Chapter 10
WORKPLACE PRIVACY
|
|
§10.01
|
Introduction to Workplace Privacy
|
|
§10.02
|
Labor and Employment Laws
|
|
§10.03
|
Background Screening of Employees and Applicants
|
|
§10.04
|
Disposal of Employee Personal Information
|
|
§10.05
|
Protection of Social Security Numbers
|
|
§10.06
|
Health Information
|
|
§10.07
|
Workplace Monitoring
|
|
§10.08
|
Privacy Torts
|
|
Chapter 11
PRIVACY POLICIES
|
|
§11.01
|
Introduction to Privacy Policies
|
|
§11.02
|
Federal Requirements
|
|
§11.03
|
State Law
|
|
§11.04
|
FTC Enforcement Actions
|
|
§11.05
|
Case Law
|
|
§11.06
|
Conclusion
|
|
Chapter 12
SURVEILLANCE LAW
|
|
§12.01
|
Introduction to Surveillance Law
|
|
§12.02
|
Electronic Communications Privacy Act of 1986
|
|
§12.03
|
Computer Fraud and Abuse Act
|
|
§12.04
|
Foreign Intelligence Surveillance Act
|
|
§12.05
|
State Surveillance Laws
|
|
Chapter 13
CYBERSECURITY AND INFORMATION SAFEGUARDS
|
|
§13.01
|
Introduction to Cybersecurity and Information Safeguards
|
|
§13.02
|
Gramm-Leach-Bliley Act
|
|
§13.03
|
Health Insurance Portability and Accountability Act of 1996
|
|
§13.04
|
Cybersecurity Information Sharing Act of 2015
|
|
§13.05
|
Federal Information Security Management Act
|
|
§13.06
|
Sarbanes-Oxley Act of 2002
|
|
§13.07
|
Red Flags Rule
|
|
§13.08
|
State Information Security Requirements
|
|
§13.09
|
Records Disposal Requirements
|
|
§13.10
|
Anti-Spyware Laws
|
|
§13.11
|
ISO 27001 and 17799/27002
|
|
§13.12
|
Statement on Standards for Attestation Engagements 16 and SOC 1, 2, and 3 Reports
|
|
§13.13
|
Payment Card Industry Data Security Standard
|
|
§13.14
|
FTC Internet of Things Guidance
|
|
§13.15
|
Federal Trade Commission “Start with Security” Guidance
|
|
§13.16
|
Cybersecurity Executive Orders
|
|
§13.17
|
Cybersecurity in the Financial Sector
|
|
§13.18
|
Cybersecurity Regulatory Developments Outside the United States
|
|
§13.19
|
Developing an Information Security Program
|
|
§13.20
|
Preventing Data Leaks
|
|
§13.21
|
Information Security Issues in Cloud Computing
|
|
§13.22
|
Ransomware Prevention and Response Guidance
|
|
§13.23
|
The Importance of Cybersecurity in Corporate Transactions
|
|
§13.24
|
The Role of the Board in Cybersecurity Governance
|
|
Chapter 14
DATA BREACH NOTIFICATION LAWS
|
|
§14.01
|
Introduction to Data Breach Notification Laws
|
|
§14.02
|
State Security Breach Notification Requirements
|
|
§14.03
|
Federal Breach Notification Requirements
|
|
§14.04
|
How to Prepare for a Security Breach
|
|
§14.05
|
How to Respond to a Security Breach
|
|
Chapter 15
CALIFORNIA CONSUMER PRIVACY ACT OF 2018 AND RELATED STATES LAWS
|
|
§15.01
|
California Consumer Privacy Act of 2018
|
|
§15.02
|
Virginia Consumer Data Protection Act
|
|
§15.03
|
Other State Laws and Related Legislative Efforts
|
|
Chapter 16
FTC AND STATE ENFORCEMENT
|
|
§16.01
|
Section 5 of the Federal Trade Commission Act
|
|
§16.02
|
Enforcement Under State “Little FTC Acts”
|
|
Chapter 17
PRIVACY TORTS
|
|
§17.01
|
Introduction to Privacy Torts
|
|
§17.02
|
Intrusion upon Seclusion
|
|
§17.03
|
Reasonable Expectation of Privacy
|
|
§17.04
|
Reduction of Damages
|
|
§17.05
|
Appropriation of Name or Likeness
|
|
§17.06
|
Public Disclosure of Private Facts
|
|
§17.07
|
False Light
|
|
PART III
INTERNATIONAL PRIVACY AND DATA PROTECTION LAWS
|
|
Chapter 18
EUROPEAN UNION DATA PROTECTION LAW
|
|
§18.01
|
Introduction to European Union Data Protection Law
|
|
§18.02
|
EU Data Protection Framework
|
|
Chapter 19
SELECT GLOBAL PRIVACY LAWS
|
|
§19.01
|
Introduction to Select Global Privacy Laws
|
|
§19.02
|
Argentina
|
|
§19.03
|
Australia
|
|
§19.04
|
Brazil
|
|
§19.05
|
Canada
|
|
§19.06
|
China
|
|
§19.07
|
Hong Kong
|
|
§19.08
|
India
|
|
§19.09
|
Israel
|
|
§19.10
|
Japan
|
|
§19.11
|
Mexico
|
|
§19.12
|
New Zealand
|
|
§19.13
|
Philippines
|
|
§19.14
|
Russia
|
|
§19.15
|
Singapore
|
|
§19.16
|
South Africa
|
|
§19.17
|
South Korea
|
|
§19.18
|
Taiwan
|
|
§19.19
|
Thailand
|
|
§19.20
|
United Arab Emirates
|
|
Appendix A
SELECTED SECURITY BREACH NOTIFICATION LAWS
|
|
Appendix B
SELECTED STATE DATA SECURITY LAWS
|
|
Appendix C
SELECTED STATE RECORDS DISPOSAL LAW
|
|
Appendix D
Selected State Social Security Number Protection Laws
|
|
Appendix E
Selected State Do-Not-Fax Laws
|
|
Appendix F
Selected State Telephone-Monitoring Laws
|
|
Appendix G
Federal Trade Commission: Selected Section 5 Enforcement Actions
|
|
Appendix H
Model GLB Notices
|
|
Appendix I
HIPAA Model Notices of Privacy Practices
|
|
Appendix J
HIPAA Model Business Associate Contracts
|
|
Appendix K
EU Standard Contractual Clauses
|
|
Appendix L
Binding Corporate Rules: Official Documents
|
|
Appendix M
EU-U.S. Privacy Shield: Principles and Supplemental Principles
|
