The European Union -
Privacy Timeline

Universal Declaration of Human Rights

1948

• December 10 - UN General Assembly adopts/proclaims the Universal Declaration of Human Rights. Article 12 states: "No one shall be subjected to arbitrary interference with his privacy, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks." (The Universal Declaration was a non-binding document, which was more aspirational, although it did set a common standard, with a vision of human rights, to which all nations could aspire.)(1)

European Convention on Human Rights

1950

• November - European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR) (Article 8), a treaty drafted under the auspices of the Council of Europe, an international organization formed in 1949, and signed by the member states. Article 8 was the main privacy statement, with two provisions: "1. Everyone has the right to respect for his private and family life, his home and his correspondence. 2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others."(2)

1953

• November - European Convention on Human Rights (ECHR), comes into force. The Convention creates the European Court of Human Rights (ECHR), sitting in Strasbourg, France, which hears cases involving allegations of violations of the Convention.(3)

Freedom of Information Act of 1966

1966

• Freedom of Information Act (FOIA) of 1966 enacted by Congess. The purpose of the law was to provide individuals the right to access information held by federal agencies, with access including the right to inspect and copy records and documents maintained by any federal agency, federal corporation, or federal department. The FOIA did provide two privacy exceptions, out of nine exceptions to disclosure, restricting access to some information. Excemption 6 restricts access to personnel and medical and similar files about an individual. Excemption 7 - the "Law Enforcement Exemption" - exempts from disclosure records or information compiled for law enforcement purposes considered an unwarranted invasion of personal privacy.(4)

Fair Credit Reporting Act

1970

• Fair Credit Reporting Act (FCRA) passed by Congress. The Fair Credit Reporting Act is intended to ensure the confidentiality of consumer credit information held by lenders and credit reporting agencies. The Act prohibits disclosure of credit files, other than for specific purposes, such as employment, insurance, and bona fide credit applications. It requires credit bureaus to provide consumers with a copy of their credit report, when requested, and allows consumers to dispute any derogatory information in a credit report.(5)

Data Protection Act (Hesse Germany)

1970

• Data Protection Act passed by the German state of Hesse.(6)

Fair Information Practice Principles

1973

• US Department of Housing, Education, and Welfare (HEW) through its Advisory Committee on Automated Personal Data Systems issues a report "Records, Computers and the Rights of Citizens" which called on Congress tp adopt a "Code of Fair Information Practices." This would become known as Fair Information Practice Principles (FIPPs) or Fair Information Practices (FIPs). The report recommends that a Fair Information Code 1) not allow for any secret personal-data record-keeping system; 2) provide an individual with a means to find out what information is maintained on them and how it is being used; 3) provide an individual with a means to prevent information collected for one purpose being used for another without his consent; 4) provide an individual with a means to amend or correct information about him; and 5) require an organization dealing with identifiable personal data to ensure the reliability of their data as well as taking measures to prevent misuse of the data.(7)

Data Act (Sweden)

1973

• Sweden enacts the Data Act, a statute to protect the privacy of personal data on computers. Sweden becomes the first country in the world to enact a comprehensive statute dealing with personal data privacy on computers.(8)

Privacy Act of 1974

1974

• Congress enacts the Privacy Act of 1974, four months after President Nixon's resignation. The Privacy Act 1) allows an individual to determine what records pertaining to them are maintained by a federal agency; 2) prevents an agency from using or disseminating such information, other than for limited purposes, without the individual's consent; 3) grants an individual access to their information, and to correct their information; and 4) requires that information is current and accurate, with adequate safeguards to prevent misuse.(9)

Family Educational Rights and Privacy Act of 1974

1974

• Congress enacts the Family Educational Rights and Privacy Act (FERPA) of 1974, which, generally, prohibits schools from releasing student "education records" without the authorization of the student and/or parent. FERPA only covers records and information from education, not information per se. FERPA rights belong to the parents or guardians of a student, until the student turns 18, or the student attends an institution of higher education, when the rights are transferred to the student. FERPA provides rights: 1) to review the student's education records; 2) to correct any inaccuracies or misleading information; 3) to control certain disclosures; 4) to file a complaint with the U.S. Department of Education. FERPA does not provide a private right of action but only allows the Secretary of Education to enforce the law, primarily through the power to end federal funding to a school for non-compliance.(10)

German Federal Data Protection Act of 1977 (Germany)

1977

• January 27 - German Federal Data Protection Act of 1977 passed by the German legislature. The Bundesdatenschutzgesetz (BDSG) prohibits the processing of personal data unless the BDSG or another legal regulation specifically permits the processing, or the person affected has given his consent.(11)

Data Protection Law of 1978 (France)

1978

• January 6 - French parliament enacts Law 78-17 on "Information Technologies, Data Files and Civil Liberties." Requires that personal data must be collected and processed fairly and lawfully for specified, explicit, and legitimate purposes, and with the consent of the data subject. In addition to the right of consent, the law gives data subjects a number of rights: right to be informed, right to object, right of access, right to correct and delete information, and right to be forgotten. Electronic communications provider must erase or render anonymous electronic commuunications traffic and location data. The 1978 law also creates and independent data protection commission. The 1978 law is said to have served as the model of European Union Directive 95/46/EC (1995).(12)

Right to Financial Privacy Act of 1978

1978

• Right to Financial Privacy Act (RFPA) of 1978 passed by Congress. The RFPA prevents banks and other financial institutions from disclosing a person's financial information to law enforcement officials without a subpoena or search warrant.(13)

Foreign Intelligence Surveillance Act of 1978

1978

• Foreign Intelligence Surveillance Act (FISA) of 1978 passed by Congress. FISA establishes standards and procedures for the use of electronic surveillance to gather "foreign intelligence" - intelligence about foreign powers and agents of foreign powers acting within the borders of the United States. FISA creates a special court, the Foreign Intelligence Surveillance Court (FISC) to review applications for authorization to conduct electronic surveillance or physical searches of a foreign power or an agent of a foreign power. In 2004, Congress would pass the Intelligence Reform and Terrorism Prevention Act (IRTPA) of 2004, which established a five-member Privacy and Civil Liberties Oversight Board (PCLOB).(14)

Privacy Protection Act of 1980

1980

• Privacy Protection Act (PPA) of 1980 passed by Congress. Restricts law enforcement or government officials from searching or seizing work product or materials of the press or media without a subpoena, although does not necessarily involve a warrant.(15)

OECD Privacy Guidelines

1980

• September 23 - Organization for Economic Cooperation and Development (OECD) issues its Privacy Guidelines (Guidelines on the Protection of Privacy and Transborder Flows of Personal Data) relating to privacy protection in the transfer of personal information across national borders. The OECD was established under US leadership in 1961 as a voluntary organization, serving primarily as a forum for ideas focusing on domestic economies, international economic systems, good governance in public service, and corporate activity, based in Paris, France, with a membership of 36 countries.(16)
• OECD Privacy Guidelines establish eight principles regarding the processing of personal data: 1) Collection Limitation Principle - There should be limits on the collection of personal data, obtained by lawful and fair means, with the consent of the data subject; 2) Data Qualiity Principle - Personal data should be relevant to the purposes used, and should be accurate, complete, and up-to-date; 3) Purpose Specification Principle - The purposes for which personal data are collected should be specified at the time of data collection and the subsequent use limited to the original purpose, and as specified when there is a change of purpose; 4) Use Limitation Principle - Personal data should not be disclosed, made available, or otherwise used for purposes other than those specified, except a) with the consent of the data subject; or b) by the authority of law; 5) Security Safeguards Principle - Personal data should be protected by reasonable security safeguards against such risks as loss or unauthorized access, destruction, use, modification, or disclosure of data; 6. Openness Principle - There should be a general policy of openness about developments, practices and policies with respect to personal data. (In basic terms, the goal of the Openness Principle is to provide the means for an individual to find out about his personal data, the main purpose it is being used for, and the identity and address of the data controller - the party in control of the data, including making decisions about its collection, what it is being used for, and how it is collected, stored, processed, or dissminated.); 7. Individual Participation Principle - (Essentially, the Individual Participation Principle is intended to allow an individual involvement at every step of data collection by someone else, including the right to know whether data is being collected about them, the right to access to the data, an appeal process if a request is denied, and the right to control data, such as having data erased, rectified, completed, or amended.); 8) Accountability Principle - The idea that a data controller - the party who controls the data and makes decisions about it - should be held accountable for compliance with the Privacy Principles. The OECD guidelines established the concepts of controller, data subject, and personal data. Personal data was a broad concept, meaning any information relating to an identified or identifiable individual, who was the data subject.(17)

Convention 108

1981

• January 28 - Convention 108 - Convention for the Protection of Individuals with Regard to the Automatic Processing of Personal Data adopted by the Council of Europe. Convention 108 provided some definitions, such as "personal data," "automatic processing," and "controller of the file" and offered some "basic principles" for data protection in the areas of "automated personal data files" and "automatic processing of personal data," in areas such as quality of data, data security, and safeguards available to individuals. However, the Convention does not impose binding norms on signatory nations and, as a result is more of an aspirational listing of goals and guidance.(18)

Privacy Act (Canada)

1983

• Privacy Act - Canadian Parliament passes The Privacy Act. The act covers data collection activities by the government. Gives individuals the right to access data held by government agencies, in areas such as pensions, employment insurance, and taxes, and establishes the concepts of notice and consent. Creates the role of a Privacy Commissioner for Canada, with responsibility for creating standards, investigating complaints, and managing enforcement of the Privacy Act.(19)

Cable Communications Policy Act of 1984

1984

• Cable Communications Policy Act (CCPA) or (Cable Act) of 1984 passed by Congress. The Act applies to cable operators and service providers. It requires cable service providers to notify subscribers of the nature and uses of personal information and allows subscribers access to their personal data. It places limits on the collection of personally identifiable information unless the subscriber has granted consent and also limits disclosure without consent, except in certain circumstances. It requires the destruction of data, if no longer necessary. It provides a private cause of action for violations. The USA PATRIOT Act of 2001 amended the Cable Act to allow disclosure to government entities of subsciber information under federal wiretap law.(20)

Electronic Communications Privacy Act of 1986

1986

• Electronic Communications Privacy Act (ECPA) of 1986 passed by Congress. The ECPA amended the Wiretap Act of 1934 (Title III of the Federal Communications Act (FCA) of 1934) to modernize federal wiretap law. The 1986 Act contains three parts: 1) the Wiretap Act (updated version of Title III); 2) the Stored Communications Act (SCA); and 3) the Pen Register Act. Where the 1934 Act had used the term "intercepted communications," the ECPA of 1986 reclassified communications into three categories: 1) "wire communications"; 2) "oral communications"; and 3) "electronic communications". The revised Wiretap Act governs the interception of communications, but only while they are in transmission. Once the communications are in storage, they are covered by the Stored Communications Act. The Pen Register Act covered technology related to tracking the origin and destination of communications. Traditionally, a pen register was a device that recorded the telephone numbers dialled from a particular phone, while a trap and trace device recorded the telephone numbers where incoming calls originated. The Pen Register Act expanded the definition of a pen register, to include, not just phone systems, but any device or system involved in transmission, such as routing, addressing, or signalling. It did not include the contents of the communication. In 1994 Congress would enact the Communications Assistance for Law Enforcement Act (CALEA) of 1994, which required telecommunications providers to utilize developing technology to help law enforcement with electronic surveillance. CALEA required all telecommunications providers to be able to isolate and intercept electronic communications and to be able to deliver them to law enforcement personnel. CALEA did require that the privacy and security of communications falling outside of what was authorized was to be protected.(21)

Privacy Act (Australia)/Australian Privacy Principles (APP)

1988

• Privacy Act - Australia passes The Privacy Act. The act covers data collection activities by organizations. The Act governs the collection, storage, disclosure, and transfer of personal information. Organizations can transfer personal information beyond Australia's borders, but only under certain conditions. The Privacy Act includes thirteen Australian Privacy Principles (APP) which require that, among other things, that collection of personal information be limited to that related to an entity's activities, that information not be used for secondary purposes with the individual's consent, that the information be accurate, updated, and complete, that individuals have access to information about them, and that individuals have the right to correct information. Creates the office of Information Commissioner, responsible for overseeing privacy activities.(22)

Computer Matching and Privacy Protection Act of 1988

1988

• Computer Matching and Privacy Protection Act (CMPPA) of 1988 passed by Congress. The CMPPA amends the Privacy Act of 1974 to require federal agencies using computer matching programs with state or non-federal entities, to have a written agreement which stated the purpose and legal authority of the program, a justification for the program, a description of the records to be matched, procedures to ensure the accuracy of the information, and prohibitions on redisclosure of the records. The CMPPA was intended to deal with privacy concerns involved in its 1977 Program Match, a program which involved a comparison of computer employee records of people receiving benefits through Aid to Families with Dependent Children to detect fraud. Program Match had been considered an exemption from the Privacy Act. The CMPPA did establish Data Integrity Boards within each agency to oversee the matching program.(23)

Employee Polygraph Protection Act of 1988

1988

• Employee Polygraph Protection Act (EPPA) of 1988 passed by Congress. The EPPA governs the use of polygraph testing of employees by employers. It applies only to private sector employers and specifically exempts the United States government, state or local governments or political sudivisions of state or local governments. The EPPA does allow polygraph tests in some cases where there is an ongoing investigation, for situations such as theft, embezzlement, or economic espionage. It also allows testing for employers engaged in security services, such as armored car services, or those providing critical infrastructure protection, such as nuclear power or water supply facilities. It does not preempt state law, where states regulate the use of polygraphs.(24)

Video Privacy Protection Act of 1988

1988

• Video Privacy Protection Act (VPPA) of 1988 passed by Congress. The VPPA prohibits videotape service providers from knowingly disclosing personal information, such as titles of videocassettes rented or purchased, without the individual's written consent. In 2012 Congress passed the Video Privacy Protection Act Amendments Act, which make it easier to obtain consent, allowing consent via electronic means.(25)

Telephone Consumer Protection Act of 1991

1991

• Telephone Consumer Protection Act (TCPA) of 1991 passed by Congress. The TCPA requires the Federal Trade Commission (FTC) to promulgate rules to protect residential telephone subscribers' privacy rights and to avoid receiving telephone solicitations to which they object. The TCPA regulates unsolicited calls where a telemarketer initiates a call to a prospective customer, requires companies to maintain their own do-not-call list, and also authorizes the establishment of a national do-not-call database.(26)

Privacy Act (New Zealand)

1993

• Privacy Act - New Zealand passes The Privacy Act. The act covers data collection activities by all organizations, public or private, and applies in all circumstances where personal information is involved. New Zealand's Privacy Act implements tweelve Privacy Principles (APP) require that, among other things, that collection of personal information be limited to that related to an entity's activities, that information not be used for secondary purposes with the individual's consent, that the information be accurate, updated, and complete, that individuals have access to information about them, and that individuals have the right to correct information. Creates office of Information Commissioner to oversee privacy activities.(27)

Driver's Privacy Protection Act of 1994

1994

• Driver's Privacy Protection Act (DPPA) of 1994 passed by Congress. The DPPA restricts the states from disclosing or selling personal information in their motor vehicle records. Personal information is defined as information that identifies an individual, such as a photograph, social security number, name, and address. The DPPA applies to state department of motor vehicles (DMVs) and their officials and employees and only applies to motor vehicle records. It does allow disclosure for law enforcement purposes, recalls, legal proceedings, and insurance claims investigations, as well as to licensed private investigative agencies. Private entities which obtain motor vehicle information cannot resell or further disseminate that information. The information can be disclosed, in some situations, where the individual consents to the disclosure.(28)

EU Data Protection Directive of 1995

1995

• October 24 - European Parliament and Council adopt Data Protection Directive (Directive 95/46/EC) "European Community Directive on Data Protection," intended to establish rules for the collection, processing, transmission, and protection of information about individuals. Established the concept of a Data Protection Authority (DPA), a member state body with responsibility for monitoring and enforcing protection of individual data. Article 29 Working Party (WP) created, serving as an advisory body, drafting guidelines, recommending legislative changes, and issuing opinions on interpretations of data protection law. The 1995 Data Protection Directive was replaced by the General Data Protection Directive (GDPR) in May of 2018 (May 25, 2018). The Article 29 Working Party was replaced by the European Data Protection Board (EDPB) by the GDPR.(29)

Health Insurance Portability and Accountability Act of 1996

1996

• Health Insurance Portability and Accountability Act (HIPAA) of 1996 enacted by Congess. The purpose of the law was to allow portability of health insurance, in order to permit employees to change jobs without having their new health plans exclude preexisting conditions. At the time, it did not create any privacy rules. The act did address the privacy issue by establishing a deadline of August 21, 1999 for Congress to enact medical information privacy rules. The act did authorize the Department of Health and Human Services (HHS) to promulgate regulations regarding health privacy. On November 3, 1999, HHS published the proposed rules, followed by a final version of the "Privacy Rule" in December 2000.(30)

EU Data Protection Directive of 1995

1998

• October 24 - 1995 Data Protection Directive (Directive 95/46/EC) becomes effective.

Identity Theft and Assumption Deterrence Act of 1998

1998

• Identity Theft and Assumption Deterrence Act (ITADA) of 1998 passed by Congress. The ITADA makes it a federal crime to knowingly transfer or use, without lawful authority, a means of identification of another person with the intent to commit, or to aid or abet, any unlawful activity that constitutes a violation of Federal law, or that constitutes a felony under any applicable State or local law.(31)

Children's Online Privacy Protection Act of 1998

1998

• Children's Online Privacy Protection Act (COPPA) of 1998 enacted by Congess. The purpose of the Act was to regulate the collection and use of children's information by Internet websites. The Act is intended to restrict the use of information gathered from children under 13 by Internet websites. COPPA only applies to websites that collect personal information from children under age 13, does not apply to information collected from adults about children under 13, and only applies to personal data collected from children themselves. In January 2013 the Federal Trade Commission (FTC) would issue amendments to its COPPA Rule, which, among other things clarified that personal information under COPPA includes a voice, audio, an image file containing a child's voice and/or image, geolocation data that reveals a street name plus city, and online contact information. The collection of personal information means the gathering of personal information by any means from a child. Children's websites must post privacy notices describing what information is collected from children and how it is used. Websites must obtain verifiable information from the parent. There is no private cause of action for violations and violations are enforced by the FTC, which can impose fines.(32)

Gramm-Leach-Bliley Act of 1999

1999

• Gramm-Leach_Bliley Act (GLBA) of 1999 (Financial Services Modernization Act) enacted by Congress. The purpose of the law was to restructure the financial service industries, which had been regulated under the Glass-Steagall Act of 1933. The Glass-Steagall Act prevented finanancial institutions, such as banks and insurance companies, from offering financial services other than their primary area of service. Because the GLBA was expected to result in greater collection, centralization, and sharing of consumer data, it added protections for privacy through its Title V. Its main provisions were a requirement of notice of its data practices to consumers and a requirement that oversight agencies, such as the Federal Trade Commission (FTC) and the Securities and Exchange Commmission (SEC), establish standards to insure the security and confidentiality of customer records and information as well as preventing unauthorized access to such records. The privacy protections of GLBA however, were somewhat limited, in that they only apply to financial information that is not public - "nonpublic personal information" consisting of "personally identifiable financial information." GLBA allows sharing of information between its affiliates and does allow sharing with nonaffiliated companies, although with some restrictions. GLBA also does not provide a private right of action. Enforcement powers are only granted to the Federal Trade Commission (FTC), federal banking regulators, and state insurance commissioners.(33)

Charter of Fundamental Rights of the European Union

2000

• December - Charter of Fundamental Rights of the European Union (CFR) (Articles 7 and 8), proclaimed by the leaders of the institutions of the European Union, at their meeting in Nice. "Article 7: Respect for private and family life" "Everyone has the right to respect for his or her private and family life, home and communications." Article 8: "Protection of personal data" "1. Everyone has the right to the protection of personal data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified. 3. Compliance with these rules shall be subject to control by an independent authority." While the 2000 Charter of Fundamental Rights provides a general expression of privacy goals, it should not be confused with the 1950 European Convention on Human Rights. There is also some confusion about whether the Charter of Fundamental Rights was merely a "proclamation" of aspirational goals or actually adopted into law, even with the 2007 Treaty of Lisbon.(34)

HIPAA Privacy Rule

2000

• December - Department of Health and Human Services (HHS) issues final version of the regulations for what would be known as the Privacy Rule or "Standards for Privacy of Individually Identifiable Health Information," establishing standards for the protection of certain health information. Administration and enforcement of the Privacy Rule is delegated to the HHS Department's Office for Civil Rights (OCR).(35)

GLBA Privacy Rule

2000

• May 24 - Federal Trade Commission (FTC) issues its financial privacy rule - Privacy Rule - for financial institutions, as required by the Gramm-Leach-Bliley Act (GLBA). The Privacy Rule requires institutions to provide a notice of privacy policies and practices to those with a relationship to the institution, distinguishing between "customers" - individuals with a continuing relationship, such as depositors or other account holders - and "consumers" - individuals who use a financial product or service on a one-time basis, such as cashing a check or making a wire transfer. Customers must receive an annual privacy notice, while consumers do not. Both customers and consumers must receive an "opt-out" notice, with the right to opt out of institutional information sharing. GLBA does not provide a private right of action for individuals, whether customers or consumers, if their information has been shared. Only the Federal Trade Commission (FTC), federal banking regulators, and state insurance commissioners are granted enforcement powers.(36)

Personal Information Protection and Electronic Documents Act (PIPEDA) (Canada)

2000

• Canadian Parliament passes the "Personal Information Protection and Electronic Document Act" (PIPEDA). PIPEDA applies to private-sector organizations in Canada thst collect, use, or disclose personal information in the course of commercial, for-profit activities. PIPEDA contains 10 Fair Information Principles: 1) Accountability - Organization is responsible for personal information under its cnotrol; 2) Identifying Purposes - Requires documentation of of the purpose for collecting personal information; 3) Consent - Individuals must consent to the collection, use, or disclosure of personal information; 4) Limiting Collection - Information can only be collected for a legitimate and identified purpose through fair and lawful means; 5) Limiting use, disclosure, and retention - Organizational use or disclosure of personal information must be limited to the identified purposes for which it was collected; 6) Accuracy - Before information is shared, the organization must ensure that it is accurate, complete, and up-to-date; 7) Safeguards - Personal informmation must be protected at a level appropriate to the informations's sensitivity; 8) Openness - An organization must have clear and easily understood personal information management practices that are made available on request; 9) Individual access - An individual has the right to access information that an organization collects and holds on them; 10) Challenging compliance - An individual must be able to challenge an organization's compliance with the fair information principles.(37)

European ePrivacy Directive

2002

• Directive on Privacy and Electronic Communications (Directive 2002/58/EC) "ePrivacy Directive" adopted by EC. The ePrivacy Directive establishes specific protections covering electronic mail, telephone communications, traffic data, calling line identification, and unsolicited communications.(38)

GLBA Safeguards Rule

2002

• May 23 - Federal Trade Commission (FTC) issues its final regulations on security standards for nonpublic personal information - Safeguards Rule - for financial institutions, as required by the Gramm-Leach-Bliley Act (GLBA). The regulations required the development, implementation, and maintenance of a comprehensive security program appropriate for the size of the institution, the nature and scope of the institution's activities, and the sensitivity of the customer informaiton. The program included the administrative, technical, and physical safeguards relating to access, collection, distribution, proceessing, storage, use, transmission, and disposal of customer informatiion.(39)

Section 208 - Privacy provisions of the US E-Government Act of 2002

2002

• December 17 - E-Government Act of 2002 signed by the President. The overall goal of the E-Government Act is to encourage the adoption of the Internet and advanced technologies by government agencies in order to promote greater efficiencies, citizen participation, government openness, and accountability. Section 208 deals with privacy, and requires agencies to conduct privacy impact assessements (PIA) before IT systems or projects are developed or procured. The PIA guidelines require agencies to determine how information is collected, stored, protected, shared and managed, and, in general, make the PIA publicly available. The privacy policies must be posted on agency websites used by the public. Agencies must report annually to the Office of Management and Budget (OMB) on their compliance with Section 208. Becomes effective April 17, 2003.(40)

Fair and Accurate Credit Transactions Act

2003

• Fair and Accurate Credit Transactions Act (FACTA) passed by Congress. The Fair and Accurate Credit Transactions Act (FACTA) amends the Fair Credit Reporting Act (FCRA) to require credit bureaus to disclose credit scores to individuals, although its requirements are limited.(41)

HIPAA Security Rule

2003

• February 20 - Health and Human Services (HHS) issues the "Security Standards for the Protection of Electronic Protected Health Information," commonly known as the HIPAA Security Rule, and delegates administration and enforcement to the Centers for Medicare and Medicaid Services (CMS) which will administer the Security Rule from 2003 to July 27, 2009. Following passage of the HITECH Act, authority to administer the Security Rule is transferred to the HHS's Office for Civil Rights (OCR).(42)

California Breach Notification Statute

2003

• California becomes the first state to enact a breach notification statute. The statute requires companies and individuals doing business in California, which maintain personal information, to notify individuals, in the event of a security breach of a computerized system, that their information has been leaked or improperly accessed.(43)

CAN-SPAM Act of 2003

2003

• Controlling the Assault of Non-solicited Pornography and Marketing (CAN-SPAM) Act of 2003 enacted by Congess. The purpose of the Act was to address the problem of spam - unsolicited commercial e-mail sent to individuals to advertise products and services. The CAN-SPAM Act applies to commercial e-mail - messages where the primary purpose is the commercial advertisement or promotion of a commercial product or service. The Act prohibits the knowing sending of commercial messages with the intent to deceive or mislead recipients. The Act requires that a valid opt-out option be available to e-mail recipients.(44)

Intelligence Reform and Terrorism Prevention Act of 2004

2004

• Intelligence Reform and Terrorism Prevention Act (IRTPA) of 2004 passed by Congress. IRTPA created the Privacy and Civil Liberties Oversight Board (PCLOB). IRTPA amended the National Security Act of 1947 to create a cabinet-level intelligence czar, the Director of National Intelligence (DNI), with oversight of agencies within the intelligence community, such as the CIA. IRTPA also created the position of Civil Liberties Protection Officer (CLPO), within ODNI.(45)

APEC Privacy Framework

2004

• November 24 - Asia-Pacific Economic Cooperation (APEC) releases its Privacy Framework - APEC Cross Border Privacy Rules (CBPR) System, comprised of a set of nine guiding principles and guidance on implementation: 1) preventing harm; 2) notice; 3) collection limitation; 4) use of personal information; 5) choice; 6) integrity; 7) security safeguards; 8) access; and 9) accountability.(46)

Video Voyeurism Prevention Act of 2004

2004

• Video Voyeurism Prevention Act of 2004 enacted by Congess. The Act criminalizes the capturing of nude images of people when on federal property, under circumstances where they have a reasonable expectation of privacy.(47)

2009

• Charter of Fundamental Rights of the European Union (CFR) (Articles 7 and 8), becomes binding on all member states, following the effective date of the Treaty of Lisbon.

Health Information Technology for Economic and Clinical Health Act (HITECH Act)

2009

• February 17 - Health Information Technology for Economic and Clinical Health Act (HITECH Act) of 2009, within the American Recoveery and Reinvestment Act of 2009, passed by Congress. The HITECH Act expands HIPAA's coverage, strengthens penalties for HiPAA violations and provides for data breach notification under HIPAA.(48)
• The breach notification requirement contained in the HITECH Act is the first federal data breach notification statute.
• July 27 - HHS Secretary transfers authority for administration of the HIPAA Security Rule from the Centers for Medicare and Medicaid Services (CMS) to the HHS's Office for Civil Rights (OCR).(49)

Generally Accepted Privacy Principles (GAPP)

2009

• Generally Accepted Privacy Princples (GAPP) - A statement of privacy principles developed by the American Institute of CPAs (AICPA) and the Canadian Institute of Chartered Accountants (CICA). GAPP Principles: 1) Management - The entity defines, documents, communicates, and assigns accountability for its privacy policies and procedures; 2) Notice - The entity provides notice about its privacy policies and procedures and identifies the purposes for which personal information is collected, used, retained, and disclosed; 3) Choice and Consent - The entity describes the choices available to the individual and obtains implicit or explicit consent with respect to the collection, use, and disclosure of personal information; 4) Collection - The entity collects personal information only for the purposes identified in the notice; 5) Use, retention, and disposal - The entity limits the use of personal information to the purposes identified in the notice and for which the inndividual has provided implicit or explicit consent. The entity retains personal information for only as long as necessary to fulfill the stated purposes or as required by law or regulations and thereafter approprately disposes of such information; 6) Access - The entity provides individuals with access to their personal information for review and update; 7) Disclosure to third parties - The entity discloses personal information to third parties only for the purposes identified in the notice and with the implicit or explicit consent of the individual; 8) Security for privacy - The entity protects personal information against unauthorized access (both physical and logical); 9) Quality - The entity maintains accurate, complete, and relevant personal information for the purposes identified in the notice; 10) Monitoring and enforcement - The entity monitors compliance with its privacy policies and procedures and has procedures to address privacy related complaints and disputes.(50)

General Data Protection Regulation (GDPR)

2012

• January 1 - European Commission publishes the General Data Protection Regulation (GDPR), a proposal to update the 1995 Data Protection Directive to allow all European Union citizens a right to have his or her personal online data removed from the Web.(51)
• Australia passes the Personally Controlled Electronic Health Records Act, covering the collection and maintenance of patient health records in electronic form.(52)

Video Privacy Protection Act Amendments Act of 2012

2012

• Video Privacy Protection Act Amendments Act of 2012 enacted by Congess. The Act amended the 1998 Video Privacy Protection Act to allow consent using electronic means.(53)

Schrems I Decision

2013

• OECD releases a revised set of the 1980 privacy guidelines. The new guidelines emphasized the need for a multifaceted national privacy strategy, privacy management programs, and data security breach notification. The new Guidelines defined a "data controller" as "a party who, according to national law, is competent to decide about the contents and use of personal data regardless of whether or not such data are collected, stored, processed or disseminated by that party or by an agent on its behalf." The data controller was required to establish a privacy management program to give effect to the Guidelines for all personal data under its control. The breach notification was to be given to both an authority and to affected individuals. (54)
• June 25 - Austrian lawyer Maximillian Schrems files a complaint against the Irish Data Protection Commissioner (DPC) for its failure to investigate allegations that Facebook Ireland Ltd was illegally transferring data to its parent company Facebook Inc., in violation of the 1995 EU Data Protection Directive (DPD). Facebook was relying on a "Safe Harbour" agreement between the United States and the European Union, approved by the EU Commission, which allowed such transfers. Edward Snowden's disclosures suggested that, in spite of the Safe Harbour agreement, US state security agencies, such as the National Security Agency (NSA), had access to personal data, violating EU data protection rights. The Irish High Court referred the case to the Court of Justice of the European Union (CJEU).(55)

HIPAA Omnibus Final Rule

2013

• January 25 - HHS issues final regulations - the "Omnibus Final Rule" - mandated by the HITECH Act. The Final Rule set security standards, primarily focused on the electronic transmission and maintenance of protected health information (PHI) - health information which identifies or relates to, a specific individual. Originally, security standards had only applied to "covered entities" which were healthcare provides, such as doctors, hospitals, clinics, dentists, and pharmacies, health plans, and healthcare clearinghouses which transmitted health informaton. The new Rules now included "business associates," organizations providing health-related services, such as claims processing, billing, or administrative services. Business associates also had to comply with security requirements. The Final Rule also added a "Breach Notification Rule," which set out new obligations relating to security breaches.(56)

EU Data Protection Directive of 1995 - Right to be Forgotten

2014

• May - Court of Justice of the European Union (CJEU) discusses "right to be forgotten" in the decision Google Spain SL v. Agencia Española de Protección de Datos, in the context of the Data Protection Directive or 1995. The right to be forgotten will be one of the more prominent, or at least headline-grabbing, themes of the General Data Protection Regulation (GDPR).(57)

Cybersecurity Act of 2015

2015

• In December 2015, Congress passed the Cybersecurity Act of 2015, which was intended to promote collaboration between the US private sector and the federal government in the area of cybersecurity. (58).

Schrems I Decision

2015

• October 6 - Court of Justice of the European Union (CJEU) declares the Safe Harbour agreement between the U.S. and the EU invalid. (Schrems I)(59)
• November 6 - European Union Commission (EC) issues guidance for companies regarding options for data transfers to the US, following the Schrems ruling.(60)

Judicial Redress Act

2016

• February 24 - Judicial Redress Act of 2015 enacted and signed into law by President Obama. The act allows EU citizens to bring claims in US courts, alleging that the federal government's handling of their personal data violated the Privacy Act of 1974.(61)

Privacy Shield

2016

• February 2 - EU and US announce agreement on a revision of the invalidated Safe Harbour.
• July 8 - EU member states adopt the Privacy Shield agreement.
• July 12 - Privacy Shield formally implemented and enters into force.
• The Privacy Shield, like the Safe Harbour agreement, would be found invalid by the European Court of Justice (CJEU) in July 2020 in what would be known as the Schrems II decision. As a result, the US Department of Commerce would create a Data Privacy Framework (DPF), a voluntary program where US companies would self-certify that they were in compliance with privacy policy requirements relating to data transfers. The European Commission would issue an adequacy decision in July 2023.(62)

General Data Protection Regulation (GDPR)

2016

• April - European Parliament approves and adopts the General Data Protection Regulation (GDPR), intended to increase data protection and privacy protection for individuals within the European Union. The GDPR updated and replaced the Data Protection Directive of 1995. The GDPR establishes guidelines relating to the collection, processing, use, protection, storage, and transfer of personal data, meaning any information which can identify an individual. The GDPR attempts to provide individuals with some control over the use of their data, such as the idea of consenting to the terms of use. The organization processing the data needs to designate a controller or data controller responsible for oversight, which might include developing a program for GDPR compliance. The GDPR establishes procedures to follow in the event of a data breach, including a notification requirement to both data subjects and to a Supervisory Authority. The European Data Protection Board (EDPB) was assigned responsibility for enforcement. The GDPR asserted jurisdiction over data processing worldwide, even where the processing took place outside the European Union. The GDPR also added a fine component, which could amount to up to 4 percent of worldwide "turnover" for violations. Although the "right to be forgotten" received the most headlines, it was only used in a parenthesis in a heading section. Instead the regulation creates a "right to erasure," which required an individual to complete and submit a form to have specific information removed by an organization. (63).

2018

• May 25 - General Data Protection Regulation (GDPR), adopted in April 2016, comes into force, replacing the Data Protection Directive of 1995.
• May 25 - European Data Protection Board (EDPB) assumes responsibility for administering data protection laws, replacing the Article 29 Working Party of the 1995 Data Protection Directive. General Data Protection Regulation (GDPR), adopted in April 2016, comes into force, replacing the Data Protection Directive of 1995.(64)

California Consumer Privacy Act

2018

• California enacts the California Consumer Privacy Act (CCPA) in 2018. The law gives an individual the right to know what information a business has collected about them, allows an individual to prevent a business from selling personal information to third parties through an "opt out" provision, provides a right to deletion, provides a right to data portability, and a right not to be penalized by a busines for exercising rights under the Act. The CCPA applies to all for-profit companies that collect and maintain personal data from California residents, do business in California, and: a) have gross revenues exceeding $25 million, or b) obtain the personal information of 50,000 or more California residents, households, or devices annually, or c) derive 50 percent or more of their annual revenues from selling California residents' personal information. The Act does not apply to banks, brokerages, insurance companies, and credit reporting agencies regulated under federal law. Enforcement of the Act is by the California Attorney General, and does not provide a private right of action for most actions. Civil penalties can be up to $7,500 per violation. The effective date of the Act is January 1, 2020.(65)

Schrems II Decision

2020

• July 16 - Schrems II decision issued by the Court of Justice of the European Union (CJEU). The decision invalidates the European Commission's adequacy determination for the 2016 Privacy Shield agreement between the EU and the U.S. The Commission had determined that the Privacy Shield agreement had enough safeguards to address privacy concerns related to the use of EU citizen's data. The CJEU decided that it lacked sufficient oversight measures to protect privacy, and also, had no method of redress, such as an appeal process, in the event of violations. As a result, the US Department of Commerce would create a Data Privacy Framework (DPF), a voluntary program where US companies would self-certify that they were in compliance with privacy policy requirements relating to data transfers. The European Commission would issue an adequacy decision in July 2023.(66)

2020

• January 1 - California Consumer Privacy Act (CCPA) of 2018 becomes effective.

Digital Markets Act (DMA) (EU)

2022

• September 14 - Digital Markets Act (DMA) adopted by the European Parliament and the Council. The Digital Markets Act is a regulation intended to make the digital sector fairer and more contestable by establishing a set of criteria to identify "gatekeepers" and to provide compliance rules for their operation. Gatekeepers are large digital platforms providing so-called core platform services, such as online search engines, app stores, and messenger services.(67)

Data Privacy Framework (DPF)

2023

• July 10 - European Commission adopts its adequacy decision for the EU-U.S. Data Privacy Framework, concluding that the United States ensures an adequate level of protection for personal data transferred from the EU to US companies participatinng in the EU-U.S. Data Privacy Framework.
• July 17 - European Commission issues adequacy decision on the EU-U.S. Data Privacy Framework (DPF).
• July 17 - Data Privacy Framework (DPF) program, allowing US-based organizations to self-certify their compliance with the requirements of the EU-U.S. Data Privacy Framework (DPF) agreement takes effect. The program is administered by the International Trade Administration (ITA) within the U.S. Department of Commerce.(68)

Digital Operational Resiliance Act (DORA) (EU)

2023

• January 16 - Digital Operational Resiliance Act (DORA) enters into force. DORA is a European Union (EU) regulation intended to strengthen the IT security of financial entities, such as banks, insurance companies, and investment firms, and provide guidance on measures to be taken to minimize disruptions and maintain operations or recover from incidents causing disruption of operations.(69)

EU Artificial Intelligence Act

2023

December - European Parliament and the Council of the EU reach political agreement on the Artificial Intelligence Act (AI Act) a regulation intended to provide a legal framework, rules, and guidance for the development and use of artificial intelligence.(70)

2024

• February - European Artificial Intelligence (AI) Office established within the European Commission. The agency is to oversee the AI Act's enforcement and implementation by the member states.(71)

Digital Operational Resiliance Act (DORA) (EU)

2025

• January 17 - Digital Operational Resiliance Act (DORA), intended to strengthen financial entity IT security applies.(72)

Notes

• 1) Charlotte A. Tschider, International Cybersecurity and Privacy Law in Practice, 8 (The Netherlands: Kluwer Law International BV, 2018) see also William McGeveran, Privacy and Data Protection Law, 67-68, 73, (USA: University Casebook Series William McGeveran, 2016)
• 2) Toni Haastrup, Lee McGowan and David Phinnemore, A Dictionary of the European Union 52, 199-200, 10th ed., (London and New York: Routledge, 2021); see also Jonathan Olsen, The European Union: Politics and Policies, 138, 7th ed., (New York and London: Routledge, 2021); see also Tschider, International Cybersecurity and Privacy Law, 8; see also Daniel J. Solove and Paul M. Schwartz, Information Privacy Law, 1183-1186, Seventh Edition, (New York: Walters Kluwer, 2021); see also William McGeveran, Privacy and Data Protection Law, 67-68, 73, (William McGeveran, 2016); see also European Court of Human Rights website at www.echr.coe.int.
• 3) Haastrup, Dictionary 52, 199-200; ; see also Olsen, The European Union, 138; see also Tschider, International Cybersecurity, 8; see also Solove, Information Privacy Law, 1183-1186; see also McGeveran, Privacy and Data Protection Law, 67-73; see also European Court of Human Rights website at www.echr.coe.int.
• 4) Solove, Information Privacy Law, 1183-1186; see also McGeveran, Privacy and Data Protection Law, 631-663.
• 5) Solove, Information Privacy Law, 38, 755-759; see also McGeveran, Privacy and Data Protection Law, 247, 322, 389-404, 677-688; see also Tschider, International Cybersecurity, 10 95-96.
• 6) Tschider, International Cybersecurity, 8.
• 7) Solove, Information Privacy Law, 37, 683-684; see also McGeveran, Privacy and Data Protection Law, 619-620; see also Tschider, International Cybersecurity, 88, 101-102.
• 8) Solove, Information Privacy Law, 1170.
• 9) Solove, Information Privacy Law, 38, 685-704; see also McGeveran, Privacy and Data Protection Law, 685-704.
• 10) Solove, Information Privacy Law, 38, 1081-1089; see also McGeveran, Privacy and Data Protection Law, 323, 883-908; see also Tschider, International Cybersecurity, 10.
• 11) Tschider, International Cybersecurity, 8.
• 12) Tschider, International Cybersecurity, 8; see also G.E. Kennedy, DATA PRIVACY LAW A Practical Guide to the GDPR, 122 (2019).
• 13) Solove, Information Privacy Law, 38, 798; see also McGeveran, Privacy and Data Protection Law, 789-796.
• 14) Solove, Information Privacy Law, 38, 447-454; see also McGeveran, Privacy and Data Protection Law, 562-578; see also Stephen Dycus, Arthur L. Berney, William C. Banks, Peter Raven-Hansen and Stephen I. Vladeck, National Security Law 633-659, Sixth Edition, (New York: Wolters Kluwer, 2016).
• 15) Solove, Information Privacy Law, 38, 366.
• 16) Solove, Information Privacy Law, 1172-1174.
• 17) Solove, Information Privacy Law, 1072-1173; see also McGeveran, Privacy and Data Protection Law, 259-260; see also Tschider, International Cybersecurity, 9.
• 18) Solove, Information Privacy Law, 1183-1184; see also McGeveran, Privacy and Data Protection Law, 83.
• 19) Tschider, International Cybersecurity, 78.
• 20) Solove, Information Privacy Law, 38, 924-926; see also McGeveran, Privacy and Data Protection Law, 820-832.
• 21) Solove, Information Privacy Law, 38, 375-384; see also McGeveran, Privacy and Data Protection Law, 339-380; see also Jeff Kosseff, Cybersecurity Law, 311-335, 513-577, Second Edition (Hoboken, NJ: John Wiley and Sons, Inc., 2020)
• 22) Tschider, International Cybersecurity, 9, 134-135.
• 23) Solove, Information Privacy Law, 38, 705-706.
• 24) Solove, Information Privacy Law, 38, 1135-1136; see also McGeveran, Privacy and Data Protection Law, 668-678.
• 25) Solove, Information Privacy Law, 38, 820, 907-921; see also McGeveran, Privacy and Data Protection Law, 833-845.
• 26) Solove, Information Privacy Law, 38, 959-967; see also McGeveran, Privacy and Data Protection Law, 846-857.
• 27) Tschider, International Cybersecurity, 134-135.
• 28) Solove, Information Privacy Law, 38, 681-683.
• 29) Solove, Information Privacy Law, 1217-1219, 1245; see also McGeveran, Privacy and Data Protection Law, 258, 262-296; see also Tschider, International Cybersecurity, 8.
• 30) Solove, Information Privacy Law, 38, 531-535; see also McGeveran, Privacy and Data Protection Law, 323, 752-774.
• 31) Solove, Information Privacy Law, 38, 802.
• 32) Solove, Information Privacy Law, 39, 926-928; see also McGeveran, Privacy and Data Protection Law, 302-323.
• 33) Solove, Information Privacy Law, 39, 792-796; see also McGeveran, Privacy and Data Protection Law, 796-814.
• 34) Solove, Information Privacy Law, 1216-1217; see also McGeveran, Privacy and Data Protection Law, 67-68, 261, 268; see also Haastrup, A Dictionary of the European Union 52, 463-464.
• 35) US Department of Health and Human Services Office for Civil Rights, Annual Report to Congress on HIPAA Privacy Rule and Security Rule Compliance For Calendar Years 2009 and 2020, 2.
• 36) Solove, Information Privacy Law, 39, 792-796; see also McGeveran, Privacy and Data Protection Law, 796-802.
• 37) Solove, Information Privacy Law, 1295-1296; see also Tschider, International Cybersecurity, 9, 78-79, 388, 393, 394.
• 38) McGeveran, Privacy and Data Protection Law, 332; see also Tschider, International Cybersecurity, 51-53; see also Dean Armstrong, Thomas Steward, and Shyam Thakerar, Cyber Risks and Insurance: The Legal Principles, 26, 62, (New York and London: Bloomsbury Professional, 2021).
• 39) Solove, Information Privacy Law, 793; see also McGeveran, Privacy and Data Protection Law, 808-810, 813; see also Tschider, International Cybersecurity, 92-94, 277-279.
• 40) Stephen D. Gantz, Daniel R. Philpot, FISMA and the Risk Management Framework The New Practice of Federal Cyber Security 446-448, 467-468, (Waltham, MA: Elsevier, Inc., 2013); see also U.S Government Printing Office website Public Law 107-347 E-Government Act of 2002 at https//www.govinfo.gov/content/pkg/PLAW-107publ347/html/PLAW-107publ347.htm, visited on September 3, 2019.
• 41) Solove, Information Privacy Law, 39, 756-759; see also McGeveran, Privacy and Data Protection Law, 403-404.
• 42) Solove, Information Privacy Law, 531-535, 546-548; see also McGeveran, Privacy and Data Protection Law, 768-771; see also Stephen S. Wu, A Guide to HIPAA Security and the Law, 7-18, Second Edition, (Chicago: American Bar Association, 2016).
• 43) Solove, Information Privacy Law, 1013-1015; see also McGeveran, Privacy and Data Protection Law, 449-455.
• 44) Solove, Information Privacy Law, 38, 967-970; see also McGeveran, Privacy and Data Protection Law, 857-859.
• 45) Solove, Information Privacy Law, 472-473; see also Stephen Dycus, Arthur L. Berney, William C. Banks, Peter Raven-Hansen, and Stephen I. Vladeck, National Security Law, 535-541, Sixth Edition, (New York: Wolters Kluwer, 2016)
• 46) Solove, Information Privacy Law, 1300-1303.
• 47) Solove, Information Privacy Law, 39, 111-113.
• 48) Solove, Information Privacy Law, 39, 532, 535, 554, 557; see also McGeveran, Privacy and Data Protection Law, 752, 765, 771.
• 49) US Department of Health and Human Services Office for Civil Rights, Annual Report to Congress on HIPAA Privacy Rule and Security Rule Compliance For Calendar Years 2009 and 2020, 2.
• 50) American Institute of Certified Public Accountants, Inc. and Canadian Institute of Chartered Accountants, Generally Accepted Privacy Principles, 2009.
• 51)Abraham Wagner and Nicholas Rostow, Cybersecurity and Cyberlaw, 401,(Durham, NC: Carolina Academic Press, 2020); see also European Data Protection Supervisor website The History of the General Data Protection Regulation at https//edps.europa.eu/data-protection/data-protection/legislation/history-general-data-protection-regulation_en, visited on January 6, 2025.
• 52) Tschider, International Cybersecurity, 134, 292.
• 53) Solove, Information Privacy Law, 38, 908; see also McGeveran, Privacy and Data Protection Law, 833, 845.
• 54) Solove, Information Privacy Law, 40, 1174-1176.
• 55) Solove, Information Privacy Law, 1267-1273; see also McGeveran, Privacy and Data Protection Law, 504-513.
• 56) Solove, Information Privacy Law, 38-39, 532; see also Stephen S. Wu, A Guide to HIPAA Security and the Law, 3-12; see also Patricia D. King, ed., HIPAA/HITECH Resource Guide, 83-103, First Edition, (Washington, D.C.:American Health Lawyers Association, 2014).
• 57) Solove, Information Privacy Law, 38, 908; see also McGeveran, Privacy and Data Protection Law, 833, 845; see also Wagner, Cybersecurity and Cyberlaw, 401-404, 441-444.
• 58) Jeff Kosseff, Cybersecurity Law, 272-276, 322-323; .
• 59) Solove, Information Privacy Law, 1267-1272; see also McGeveran, Privacy and Data Protection Law, 504-514.
• 60) From BakerMcKenzie website, Data Protection EMEA December 2019 Schrems I
• 61) From the Office of Privacy and Civil Liberties website, Overview of the Privacy Act: 2020 Edition Judicial Redress Act at https://www.justice.gov/opci/overview-privacy-act-1974-2020-edition/JRA
• 62) Solove, Information Privacy Law, 1283-1295; see also McGeveran, Privacy and Data Protection Law, 504-514; see also Department of Commerce International Trade Administration website Data Privacy Framework (DPF) Program Overview, at https://www.dataprivacyframework.gov/Program-Overview, visited on April 4, 2024 and Key Requirements for DPF Program Participating Organizations, at https://www.dataprivacyframework.gov/key-requirements, visited on April 11, 2024; see also Federal Trade Commission (FTC) website Data Privacy Framework, at https://www.ftc.gov/business-guidance/privacy-security/data-privacy-framework, visited on April 11, 2024.
• 63) Solove, Information Privacy Law, 1245-1251; see also McGeveran, Privacy and Data Protection Law, 298-300; see also EUR-Lex website General Data Protection Regulation, at https://eur-lex.europa.eu/legal-content/EN/TXT, visited on June 10, 2024; see also European Data Protection Supervisor website The History of the General Data Protection Regulation, visited on April 11,2024.
• 64) Solove, Information Privacy Law, 1245-1251; see also McGeveran, Privacy and Data Protection Law, 298-300.
• 65) Solove, Information Privacy Law, 40, 970-973.
• 66) Solove, Information Privacy Law, 1283-1295; see also Department of Commerce International Trade Administration website Data Privacy Framework (DPF) Program Overview, at https://www.dataprivacyframework.gov/Program-Overview, visited on April 4, 2024 and Key Requirements for DPF Program Participating Organizations, at https://www.dataprivacyframework.gov/key-requirements, visited on April 11, 2024; see also Federal Trade Commission (FTC) website Data Privacy Framework, at https://www.ftc.gov/business-guidance/privacy-security/data-privacy-framework, visited on April 11, 2024.
• 67) European Commission website About the Digital Markets Act, at https://digital-markets-act.ec.europa.eu/about-dma_en, visited on July 23, 2024.
• 68) Solove, Information Privacy Law, 1283-1295; see also Department of Commerce International Trade Administration website Data Privacy Framework (DPF) Program Overview, at https://www.dataprivacyframework.gov/Program-Overview, visited on April 4, 2024 and Key Requirements for DPF Program Participating Organizations, at https://www.dataprivacyframework.gov/key-requirements, visited on April 11, 2024; see also Federal Trade Commission (FTC) website Data Privacy Framework, at https://www.ftc.gov/business-guidance/privacy-security/data-privacy-framework, visited on April 11, 2024.
• (69) European Insurance and Occupational Pensions Authority website Digital Operational Resilience Act (DORA), at https://www.eiopa.europa.eu/digital-operational-resilience-act-dora_en, visited on December 31, 2024.
• 70) European Commission website AI Act|Shaping Europe's digital future, at https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai, visited on August 12, 2024.
• 71) European Commission website AI Act|Shaping Europe's digital future, at https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai, visited on August 12, 2024.
• (72) European Insurance and Occupational Pensions Authority website Digital Operational Resilience Act (DORA), at https://www.eiopa.europa.eu/digital-operational-resilience-act-dora_en, visited on December 31, 2024.