American lattice work of narrowly-tailored laws, and regulations at the federal and
state levels enable government authorities, and, in some cases, private individuals, to
bring lawsuits against organizations that are violating the law. However, in contrast
to the European Union’s data protection approach, which in many ways represents
the gold standard of privacy protections, the dominant approach in the U.S. is
grounded in consumer protection regulations.
15 Accordingly, in the United States,
it is the Federal Trade Commission (FTC), an independent U.S. law enforcement
agency charged with protecting consumers, which has become the primary privacy
enforcement agency. However, because the FTC’s primary legal authority comes
from Section 5 of the Federal Trade Commission Act,
16 the FTC’s jurisdiction is
limited to challenging privacy violations by organizations whose information practices have been deemed “deceptive” or “unfair”.
17 In that sense, the Privacy Act is
not specifically a data privacy law, but rather a system of broad consumer protection
laws that have “been used to prohibit unfair or deceptive practices involving the
disclosure of, and security procedures for protecting, personal information”.
18
In addition to its authority to take action against deceptive or unfair trade
practices, Congress has granted the FTC authority to enforce several sector specific
laws which include: “the Truth in Lending Act,
19 the CAN-SPAM Act,
20 the
Children’s Online Privacy Protection Act,
21 the Equal Credit Opportunity Act,
22
the Fair Credit Reporting Act,
23 the Fair Debt Collection Practices Act,
24 and the
Telemarketing and Consumer Fraud and Abuse Prevention Act”.
25 In addition, the
Identity Theft Assumption and Deterrence Act charges the FTC which establishing a
centralized complaint and consumer education service for victims of identity theft
and strengthens the criminal laws concerning identity theft.
26
15 McGeveran (2016), pp. 959 and 961.
16 The Federal Trade Commission Act (15 U.S.C. §§41–58) (FTC Act).
17 Sotto and Simpson (2014), p. 191.
18 Jolly (2016).
19 15 U.S.C §1601.
20 15 U.S.C. §7704.
21 15 U.S.C. §§6501–6506 (restricts the online collection of personal information from children
under the age of 13).
22 15 U.S.C. § 1691.
23 15 U.S.C. § 1681 (regulates the use and disclosure of “consumer reports” by consumer reporting
agencies).
24 15 U.S.C. § 1692.
25 15 U.S.C. § 6101–6108 (protects consumers from invasive and fraudulent telemarketing
practices).
26 18 U.S.C. § 1028.
Data Protection in the United States: U.S. National Report
411
state levels enable government authorities, and, in some cases, private individuals, to
bring lawsuits against organizations that are violating the law. However, in contrast
to the European Union’s data protection approach, which in many ways represents
the gold standard of privacy protections, the dominant approach in the U.S. is
grounded in consumer protection regulations.
15 Accordingly, in the United States,
it is the Federal Trade Commission (FTC), an independent U.S. law enforcement
agency charged with protecting consumers, which has become the primary privacy
enforcement agency. However, because the FTC’s primary legal authority comes
from Section 5 of the Federal Trade Commission Act,
16 the FTC’s jurisdiction is
limited to challenging privacy violations by organizations whose information practices have been deemed “deceptive” or “unfair”.
17 In that sense, the Privacy Act is
not specifically a data privacy law, but rather a system of broad consumer protection
laws that have “been used to prohibit unfair or deceptive practices involving the
disclosure of, and security procedures for protecting, personal information”.
18
In addition to its authority to take action against deceptive or unfair trade
practices, Congress has granted the FTC authority to enforce several sector specific
laws which include: “the Truth in Lending Act,
19 the CAN-SPAM Act,
20 the
Children’s Online Privacy Protection Act,
21 the Equal Credit Opportunity Act,
22
the Fair Credit Reporting Act,
23 the Fair Debt Collection Practices Act,
24 and the
Telemarketing and Consumer Fraud and Abuse Prevention Act”.
25 In addition, the
Identity Theft Assumption and Deterrence Act charges the FTC which establishing a
centralized complaint and consumer education service for victims of identity theft
and strengthens the criminal laws concerning identity theft.
26
15 McGeveran (2016), pp. 959 and 961.
16 The Federal Trade Commission Act (15 U.S.C. §§41–58) (FTC Act).
17 Sotto and Simpson (2014), p. 191.
18 Jolly (2016).
19 15 U.S.C §1601.
20 15 U.S.C. §7704.
21 15 U.S.C. §§6501–6506 (restricts the online collection of personal information from children
under the age of 13).
22 15 U.S.C. § 1691.
23 15 U.S.C. § 1681 (regulates the use and disclosure of “consumer reports” by consumer reporting
agencies).
24 15 U.S.C. § 1692.
25 15 U.S.C. § 6101–6108 (protects consumers from invasive and fraudulent telemarketing
practices).
26 18 U.S.C. § 1028.
Data Protection in the United States: U.S. National Report
411