1.3 Major Sector-Specific Legislation and the Classification
of Data
In addition to the legislation that comes within the FTC’s jurisdiction, there are
several other major pieces of federal sector-specific legislation:
1. Financial Services Modernization Act (Gramm-Leach-Bliley Act (GLB)) (15 U.
S.C. §§6801–6827).
2. Health Insurance Portability and Accountability Act (HIPAA) (42 U.S.C. §1301
et seq.)
3. Controlling the Assault of Non-Solicited Pornography and Marketing Act
(CAN-SPAM Act) (15 U.S.C. §§7701–7713 and 18 U.S.C. §1037)
4. The Fair Credit Reporting Act (15 U.S.C. §1681).
5. Electronic Communications Privacy Act (18 U.S.C. §2510) regulates the interception of electronic communications
6. The Computer Fraud and Abuse Act (18 U.S.C. §1030) which criminalizes
computer tampering.
Legislation title
Definition personal
data
27
Data classifications
Processing of
information
Financial Services
Modernization Act:
(Gramm-Leach-Bliley
Act) Protects consumers’ “nonpublic”
personal information
when used by financial institutions
“Nonpublic personal
information” means
personally identifiable
financial information
that is provided by a
consumer to a financial institution;
resulting from a transaction with the consumer or from a
service provided to
the consumer; or otherwise obtained by the
financial institution
28
Nonpublic personal
information is
protected. Publicly
available personal
information is not
protected
Financial institutions
may transfer personal
information to other
companies if it is
necessary to the
performed financial
services. Information
may be shared with
credit reporting
agencies or financial
regulatory agencies
29
Health Insurance Portability and Accountability Act (HIPPA)
‘Protected health
information’ means
individually identifiable health information: (1) Except as
Under the Act there is
protected health information (PHI) and
“electronic Protected
Health Information”.
The Security Rule
establishes the minimum requirements
for all health care
entities and
(continued)
27 The legislative enactments in this chart are not based on sector specific protections rather than on
broad rights to personal data protection as exist in the European Union.
28 15 U.S. Code §6809(4).
29 https://epic.org/privacy/glba/.
412
S. M. Boyne
of Data
In addition to the legislation that comes within the FTC’s jurisdiction, there are
several other major pieces of federal sector-specific legislation:
1. Financial Services Modernization Act (Gramm-Leach-Bliley Act (GLB)) (15 U.
S.C. §§6801–6827).
2. Health Insurance Portability and Accountability Act (HIPAA) (42 U.S.C. §1301
et seq.)
3. Controlling the Assault of Non-Solicited Pornography and Marketing Act
(CAN-SPAM Act) (15 U.S.C. §§7701–7713 and 18 U.S.C. §1037)
4. The Fair Credit Reporting Act (15 U.S.C. §1681).
5. Electronic Communications Privacy Act (18 U.S.C. §2510) regulates the interception of electronic communications
6. The Computer Fraud and Abuse Act (18 U.S.C. §1030) which criminalizes
computer tampering.
Legislation title
Definition personal
data
27
Data classifications
Processing of
information
Financial Services
Modernization Act:
(Gramm-Leach-Bliley
Act) Protects consumers’ “nonpublic”
personal information
when used by financial institutions
“Nonpublic personal
information” means
personally identifiable
financial information
that is provided by a
consumer to a financial institution;
resulting from a transaction with the consumer or from a
service provided to
the consumer; or otherwise obtained by the
financial institution
28
Nonpublic personal
information is
protected. Publicly
available personal
information is not
protected
Financial institutions
may transfer personal
information to other
companies if it is
necessary to the
performed financial
services. Information
may be shared with
credit reporting
agencies or financial
regulatory agencies
29
Health Insurance Portability and Accountability Act (HIPPA)
‘Protected health
information’ means
individually identifiable health information: (1) Except as
Under the Act there is
protected health information (PHI) and
“electronic Protected
Health Information”.
The Security Rule
establishes the minimum requirements
for all health care
entities and
(continued)
27 The legislative enactments in this chart are not based on sector specific protections rather than on
broad rights to personal data protection as exist in the European Union.
28 15 U.S. Code §6809(4).
29 https://epic.org/privacy/glba/.
412
S. M. Boyne