1.2 Evolution of Personal Data Protection
The first data privacy legislation in the United States,
3 the Fair Credit Reporting Act
(FCRA), was enacted in 1970.
4 The FCRA aimed to impose limits on data sharing in
the consumer credit reporting industry and, in particular, to make it easier for
individuals to correct reporting errors.
5 The FCRA established a tripartite model
for subsequent data protection legislation that (1) provided notice to consumers of a
specific type of data record, (2) established an administrative redress procedure
administered by a government agency, and (3) defined the conditions under which
law enforcement could access the data by meeting various standards of proof.
6
In 1973, the U.S. Department of Health, Education, and Welfare (HEW)
published a report entitled “Computers and the Rights of Citizens” which
recommended that the government enact a Code of Fair Information Practices
(FIPs).
7 Those practices would bind all organizations to comply with a code that
would seek to protect personally identifiable information.
8 Practices that did not
meet the standards of the code would be subject to government sanction.
9 In 1974, in
the aftermath of the Watergate scandal, Congress ratified the Privacy Act.
10 Despite
the fact that the HEW report called for legislation that would apply to “all automated
personal data systems”,
11 the final legislation applied only to federal agency databases.
12 The Act declared that “the right to privacy is a personal and fundamental
right protected by the Constitution of the United States”.
13 The Privacy Act protects
personal information that the U.S. General Services Administration maintains in
systems of records (SORs).
14
Despite the fact that Congress declared its commitment to the right to data privacy
in 1974, the U.S. continues to lack a comprehensive data protection framework. The
supplemented by civil suits; (5) other legal standards that are relatively strict for government
access in many non-search situations, such as the judge-supervised “reasonable and articulable suspicion” standard under ECPA; (6) transparency requirements, such as notice to the
service provider of the legal basis for a request; (7) lack of data retention requirements for
internet communications; and (8) lack of limits on use of strong encryption.
3 Although European states commonly use the term “data protection”, the phrase “data privacy” is
more common in the United States. Swire and Ahmad (2012), p. 4.
4 Title VI of Pub.L. 91-508, 84 Stat. 1114, enacted October 26, 1970.
5 15 U.S.C. § 1681 et seq.
6 Cobb (2016), p. 2.
7 Id. at 3.
8 Id.
9 Id.
10 5 U.S.C. § 552.
11 Ware (1973), p. 5.
12 5 U.S.C. § 551(a).
13 Raul et al. (2014), pp. 268–294 at 269.
14 5 U.S.C. § 552a(a)(5).
410
S. M. Boyne
The first data privacy legislation in the United States,
3 the Fair Credit Reporting Act
(FCRA), was enacted in 1970.
4 The FCRA aimed to impose limits on data sharing in
the consumer credit reporting industry and, in particular, to make it easier for
individuals to correct reporting errors.
5 The FCRA established a tripartite model
for subsequent data protection legislation that (1) provided notice to consumers of a
specific type of data record, (2) established an administrative redress procedure
administered by a government agency, and (3) defined the conditions under which
law enforcement could access the data by meeting various standards of proof.
6
In 1973, the U.S. Department of Health, Education, and Welfare (HEW)
published a report entitled “Computers and the Rights of Citizens” which
recommended that the government enact a Code of Fair Information Practices
(FIPs).
7 Those practices would bind all organizations to comply with a code that
would seek to protect personally identifiable information.
8 Practices that did not
meet the standards of the code would be subject to government sanction.
9 In 1974, in
the aftermath of the Watergate scandal, Congress ratified the Privacy Act.
10 Despite
the fact that the HEW report called for legislation that would apply to “all automated
personal data systems”,
11 the final legislation applied only to federal agency databases.
12 The Act declared that “the right to privacy is a personal and fundamental
right protected by the Constitution of the United States”.
13 The Privacy Act protects
personal information that the U.S. General Services Administration maintains in
systems of records (SORs).
14
Despite the fact that Congress declared its commitment to the right to data privacy
in 1974, the U.S. continues to lack a comprehensive data protection framework. The
supplemented by civil suits; (5) other legal standards that are relatively strict for government
access in many non-search situations, such as the judge-supervised “reasonable and articulable suspicion” standard under ECPA; (6) transparency requirements, such as notice to the
service provider of the legal basis for a request; (7) lack of data retention requirements for
internet communications; and (8) lack of limits on use of strong encryption.
3 Although European states commonly use the term “data protection”, the phrase “data privacy” is
more common in the United States. Swire and Ahmad (2012), p. 4.
4 Title VI of Pub.L. 91-508, 84 Stat. 1114, enacted October 26, 1970.
5 15 U.S.C. § 1681 et seq.
6 Cobb (2016), p. 2.
7 Id. at 3.
8 Id.
9 Id.
10 5 U.S.C. § 552.
11 Ware (1973), p. 5.
12 5 U.S.C. § 551(a).
13 Raul et al. (2014), pp. 268–294 at 269.
14 5 U.S.C. § 552a(a)(5).
410
S. M. Boyne