UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 6.3 Free with a free account
Domestic Laws and Regulations That Govern Data Protection in the United States
Ethics in Technology · Chapter 6: When Big Data Becomes a Big Risk: Security Gaps, Legal Frameworks, and National DefenseSection 6.3 · lesson 24 of 11616 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: International Data Protection Frameworks and Cross-Border Compliance Challenges →← How Large-Scale Data Storage and Processing Create New Targets for Cyber AttackersNext lesson: International Data Protection Frameworks and Cross-Border Compliance Challenges →
In this lesson
Match the information, organization, use, and jurisdiction.
- Compare the sectoral and comprehensive approaches
- Identify major federal laws and their boundaries
- Explain FTC unfairness and deception authority
- Apply California rights and recognize state variation
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,910 words). Read along, or search it.
Chapter 6
U.S. Data Protection Laws
United States data protection relies heavily on sector-specific laws, general consumer protection, and state requirements. The law that applies can depend, on the information, organization, activity, and jurisdiction. This lesson introduces major federal statutes, alongside California's broader consumer privacy framework. HIPAA concerns protected health information, within the scope of covered entities and business associates. GLBA addresses financial privacy and security, while COPPA creates specific protections for young children online. FERPA governs covered education records, and FCRA regulates consumer reports used for consequential decisions. FTC Section five provides another route, through its authority over unfair or deceptive practices. California rights include knowing, deleting, correcting, and limiting particular uses of personal information. Other states add different frameworks, creating overlaps and variations that require careful attention. Worked examples show how to identify a starting point, without treating a short label as the complete legal answer. Begin with what information is involved, and who holds or uses it for the relevant activity.
A Sectoral Framework
The Same Information Can Fall Under Different Rules
A sectoral approach uses separate rules for particular industries, data types, or activities. Health, finance, education, credit reporting, and children's online collection, each have important federal statutes. The FTC's general authority also matters, within the limits of its jurisdiction and applicable law. State requirements add another layer, sometimes covering information that a federal sector statute does not reach. A comprehensive framework such as GDPR supplies broader common principles, while retaining scope limits and exceptions. Neither approach makes the entire legal analysis, reducible to a single unqualified statement about data sensitivity. The same health-related fact can appear in a hospital record or an independent consumer application. Those settings may produce different obligations, despite the fact being equally sensitive to the person. Ask what information is involved, which entity handles it, and what activity is taking place. Then check jurisdiction, thresholds, exclusions, effective dates, and relevant exceptions. This structured approach reveals both applicable protections, and the gaps or overlaps that need further attention.
HIPAA, 1996
Health Sensitivity Alone Does Not Establish HIPAA Coverage
HIPAA was enacted in nineteen ninety-six, and its rules protect information within their defined scope. Covered entities include health plans, clearinghouses, and providers conducting the relevant covered electronic transactions. Certain service providers become business associates, when handling protected information for covered entities. Protected health information includes identifiable health, care, or payment information, subject to the applicable definitions. The Privacy Rule limits uses and disclosures, and supports access and requests to amend records. The Security Rule concerns electronic protected health information, using administrative, physical, and technical safeguards. Access controls, audit processes, and staff responsibilities, help implement those safeguards in practice. HHS civil-rights officials handle civil enforcement, while criminal enforcement belongs to the Department of Justice. Health sensitivity alone does not make every holder, a HIPAA-covered entity or business associate. An independent fitness or period-tracking application may fall outside HIPAA, while other rules still apply. Check the organization and relationship, rather than concluding that all health-related information has identical protection.
GLBA, 1999
Financial Privacy Includes Sharing Rules and Security Duties
GLBA, enacted in nineteen ninety-nine, addresses qualifying financial institutions and nonpublic personal information. Coverage can include lenders, advisers, tax preparers, and other financial businesses beyond ordinary banks. Financial privacy rules require notices, and opt-out opportunities for certain sharing with nonaffiliated third parties. Exceptions mean that not every disclosure, depends on the same opt-out process. Safeguards requirements concern an appropriate written security program, under the applicable regulator's rules. The FTC strengthened its Safeguards Rule, adding more specific requirements for institutions within its coverage. Qualified security leadership, risk assessments, encryption, and multifactor authentication, are among those requirements. Pretexting provisions address obtaining customer financial information, through false pretenses rather than legitimate authority. The FTC, CFPB, banking regulators, and other authorities, have responsibilities that differ by institution and rule. An opt-out structure can put responsibility on the consumer to act against particular types of sharing. Assess the precise entity, disclosure, and exception, before assuming every financial use follows one rule.
COPPA, 1998
Children Under 13 Receive Specific Online Protections
COPPA was passed in nineteen ninety-eight, and its original rule took effect in two thousand. It creates specific online privacy protections for children younger than thirteen. Coverage includes child-directed commercial services, and general-audience operators with actual knowledge of covered child collection. Operators generally need notice and verifiable parental consent, with limited exceptions defined by the rule. Parents have review and deletion opportunities, alongside protections concerning security and justified retention. The two thousand twenty-five amendments add separate consent for certain third-party disclosures such as targeted advertising. Disclosures integral to providing the service are treated differently, so the exception and purpose matter. Google and YouTube's historical settlement was one hundred seventy million dollars in two thousand nineteen. Epic Games' two thousand twenty-two COPPA matter included a two hundred seventy-five million dollar penalty. FTC and state enforcement can apply, with consequences depending on the particular legal requirements and case. COPPA's age boundary does not mean teenagers lack every protection, under other federal or state rules.
FERPA, 1974
Education Rights Transfer to an Eligible Student
FERPA, enacted in nineteen seventy-four, governs education records at institutions within its funding-based coverage. Records can include grades, transcripts, discipline, schedules, and financial-aid information. Parents generally hold rights for schoolchildren, until the student becomes an eligible student. Rights transfer at eighteen, or upon entering postsecondary education at any age. The rights include inspecting records, seeking correction of inaccurate information, and controlling disclosure subject to exceptions. School officials need a legitimate educational interest, when relying on that particular disclosure exception. Directory information can be released, only within the applicable notice and opt-out framework. Exceptions can also address transfers, emergencies, and other circumstances defined by the law. A parent's payment of college tuition does not by itself, create unrestricted access to the student's grades. Tax dependency can permit parental disclosure, under an exception rather than automatically transferring the student's rights. The Department of Education enforces FERPA, and a disclosure requires attention to the actual consent or exception.
FCRA, 1970
Consumer Reports Affect Credit, Work, and Housing
FCRA, enacted in nineteen seventy, regulates consumer reporting agencies, users of reports, and information furnishers. Consumer reports can influence credit, employment, housing, and other consequential decisions. A report must have a permissible purpose, and employment use generally requires written authorization. Reporting agencies need reasonable accuracy procedures, while furnishers have applicable duties concerning supplied information. People can dispute errors, with investigation generally required within thirty days and possible extensions. Official free-report channels help people inspect, the information used to assess their history. Adverse-action notices identify the report source, and provide relevant information about the person's rights. Many negative entries have time limits, often seven years, while exceptions and other limits apply. The FTC and CFPB have enforcement responsibilities, alongside other applicable authorities and statutory remedies. FCRA also permits private claims, under its defined liability provisions and required conditions. An incorrect fact deserves correction, without assuming that every inaccuracy automatically proves every element of legal liability.
FTC Act Section 5, 1914
Deception and Unfairness Are Separate Routes
Section five of the FTC Act prohibits, unfair or deceptive practices within its applicable jurisdiction. Deception can involve a material representation, omission, or practice likely to mislead consumers in context. A company promising no sharing, then sharing contrary to that promise, illustrates a possible deceptive practice. Unfairness is a separate route, with a test focused on substantial actual or likely consumer injury. The injury must not be reasonably avoidable, or outweighed by benefits to consumers or competition. That route does not require, a broken privacy promise before the conduct can be examined. The two thousand fifteen Wyndham appellate decision affirmed FTC authority to challenge unreasonable data security under unfairness. Consent orders can impose continuing obligations, including requirements to improve practices and undergo monitoring. Violating an existing order can bring penalties, as Facebook's broader privacy settlement illustrated. Section five is therefore more than a mechanism for enforcing the wording of privacy policies. It still does not itself supply the complete set of rights, associated with a comprehensive consumer privacy statute.
California Coverage
CPRA Amended the CCPA and Created the Privacy Agency
California enacted CCPA in two thousand eighteen, with the law taking effect in two thousand twenty. Voters approved CPRA that year, amending CCPA rather than creating a separate unrelated framework. Its main amendments applied from two thousand twenty-three, and created a dedicated privacy agency. The principal business definition addresses qualifying for-profit entities, doing business in California and meeting a threshold. One route uses an inflation-adjusted annual-revenue threshold, rather than a permanently fixed twenty-five million dollars. Another concerns buying, selling, or sharing information of at least one hundred thousand consumers or households. A third concerns deriving at least half of annual revenue from selling or sharing personal information. Related-entity rules and exemptions also matter, alongside separate obligations for service providers and contractors. The privacy agency and attorney general enforce the law, within their applicable responsibilities. Private actions are limited, including certain qualifying data-breach situations rather than every possible privacy violation. Use the current statute and adjustment, when evaluating coverage in a real case.
California Rights
Rights Have Scope, Procedures, and Exceptions
California residents have rights, within CCPA's scope and applicable conditions. The right to know concerns collected personal information, its uses, and disclosures. Deletion requests can require removal, while legal obligations and other defined exceptions may permit retention. Correction addresses inaccurate personal information, through the applicable request and verification process. Opt-out rights concern sale, and sharing for cross-context behavioral advertising as defined by the law. The sensitive-information right limits uses beyond specified permitted purposes rather than prohibiting every use. Equal-treatment protections address prohibited discrimination for exercising privacy rights. Financial-incentive and value-related provisions require careful application, rather than treating every price difference identically. Scope, exemptions, identity verification, and statutory procedures, can affect how a request must be handled. Businesses should not assume a right is meaningless, simply because some exceptions exist. People should also avoid assuming that every request, overrides every lawful reason for retaining or processing information.
Other States and Gaps
Broader and Targeted Laws Add Different Layers
Other states add broader consumer frameworks, with different thresholds, exemptions, effective dates, and enforcement. Virginia and Colorado illustrate states that adopted such frameworks following California's early legislation. Illinois's biometric law creates specific duties for covered private collection and use of biometric information. These include notice, a written release, retention requirements, and a route to private enforcement. Washington's My Health My Data Act addresses, certain consumer health information outside HIPAA's reach. The source's national state-law count is time-sensitive, so a permanent lesson should not treat it as fixed. Consult the relevant enacted law, and distinguish passage from the date its obligations become effective. Data brokers, browsing, location, and consumer health applications, can encounter different protections across jurisdictions. Teenagers may also have different protections, despite falling outside COPPA's specific under-thirteen scope. Outside one sector statute does not mean outside all law, including general consumer-protection or notification requirements. The practical challenge is to identify applicable layers, rather than assume a single label settles the whole case.
Worked Cases
Match the Holder and Activity Before Naming the Law
A covered hospital worker snooping on a patient, gives HIPAA as a likely starting point. A funded college disclosing an eligible student's grades, requires FERPA consent or an applicable exception. A child-directed game collecting covered information from nine-year-olds, raises COPPA duties concerning parental consent. A housing denial based on an inaccurate consumer report, raises FCRA notice and dispute protections. A meditation application breaking its no-sharing promise, can raise FTC deception and other applicable rules. Each answer begins the analysis, rather than establishing every legal conclusion without further facts. Check the entity, information, activity, age, jurisdiction, threshold, and relevant exception. The same sensitive fact may receive different protections, depending on whether it appears in a hospital or commercial app. The framework's gaps and overlaps matter, both for organizations and for people trying to exercise their rights. Do not confuse broad sensitivity, with automatic coverage under whichever law first sounds relevant. Match the actual situation carefully, then use current authoritative requirements to assess the duties and available remedies.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About Domestic Laws and Regulations That Govern Data Protection in the United States
Does the United States have a comprehensive federal data privacy law?
Does HIPAA apply to health and fitness apps?
What rights does FERPA give students?
Which businesses have to comply with the CCPA?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →