Name
Code sections
Actions targeted
Criminal penalty
or imprisonment for not
more than 1 year or
both, in the case of a
first offense under this
paragraph; and
(B) a fine under this title
or imprisonment for not
more than 5 years, or
both, in the case of an
offense under this
subparagraph that
occurs after a conviction
of another offense under
this section
303
7 Private International Law Rules
7.1 U.S. Legislation
Consistent with the U.S. national commitment to free and fair trade, the U.S. does
not have many specific rules that govern the transfer of data outside of the county,
beyond the “basic fair information principles for notice and prohibitions on deceptive or unfair business practices”.
304 Nor does the United States have any forced
localization requirements for data servers with the exception of the data used by
certain government agencies.
305 As one example, in 2016, the Internal Revenue
Service (IRS) issued security guidelines that require federal agencies to “restrict the
location of information systems that receive, process, store, or transmit [federal tax
information] to areas within the United States territories, embassies, or military
installations”.
Foreign organizations that operate in the United States are considered responsible
parties under U.S. law provided that the organization satisfies American jurisdictional requirements. Foreign organizations may be subject to sector-specific laws,
such as those enforced by the FTC and the Department of Health and Human
Services.
The Safe Web Act
306 amended the jurisdiction of the FTC under Section 5(a) of
the FTC Act to regulate “unfair or deceptive acts or practices” to include “such acts
303 18 U.S.C. §2701(b).
304 Brown et al. (2017).
305 Raul et al. (2014), p. 286.
306 Pub. L. No. 109–455, 120 Stat. 3372, extended by Pub. L. No. 112–203, 126 Stat. 1484, codified
at 15 U.S.C. §§ 41 et seq.
Data Protection in the United States: U.S. National Report
451
Code sections
Actions targeted
Criminal penalty
or imprisonment for not
more than 1 year or
both, in the case of a
first offense under this
paragraph; and
(B) a fine under this title
or imprisonment for not
more than 5 years, or
both, in the case of an
offense under this
subparagraph that
occurs after a conviction
of another offense under
this section
303
7 Private International Law Rules
7.1 U.S. Legislation
Consistent with the U.S. national commitment to free and fair trade, the U.S. does
not have many specific rules that govern the transfer of data outside of the county,
beyond the “basic fair information principles for notice and prohibitions on deceptive or unfair business practices”.
304 Nor does the United States have any forced
localization requirements for data servers with the exception of the data used by
certain government agencies.
305 As one example, in 2016, the Internal Revenue
Service (IRS) issued security guidelines that require federal agencies to “restrict the
location of information systems that receive, process, store, or transmit [federal tax
information] to areas within the United States territories, embassies, or military
installations”.
Foreign organizations that operate in the United States are considered responsible
parties under U.S. law provided that the organization satisfies American jurisdictional requirements. Foreign organizations may be subject to sector-specific laws,
such as those enforced by the FTC and the Department of Health and Human
Services.
The Safe Web Act
306 amended the jurisdiction of the FTC under Section 5(a) of
the FTC Act to regulate “unfair or deceptive acts or practices” to include “such acts
303 18 U.S.C. §2701(b).
304 Brown et al. (2017).
305 Raul et al. (2014), p. 286.
306 Pub. L. No. 109–455, 120 Stat. 3372, extended by Pub. L. No. 112–203, 126 Stat. 1484, codified
at 15 U.S.C. §§ 41 et seq.
Data Protection in the United States: U.S. National Report
451