Cyber-security Law
A
The Children’s Online Privacy Protection Act (COPPA) was passed in 1998 and established the first framework for online privacy protection for children under 13 who use the Internet. Essentially, COPPA mandates what personal and marketing information, if any, webmasters can collect from minors and details what must be disclosed in a privacy policy. Given the expansive nature of data collection and widespread use of Internet connected devices, should COPPA be expanded to: (1) children who are 13-18 years old or (2) all citizens utilizing the Internet? Why or why not? How would your answer affect/align with business objectives?
B
Information privacy or data protection laws are generally designed to prohibit publication or misuse of information about private individuals. Many countries around the world, including all of Europe, have adopted some form of comprehensive data protection legislation. In the United States however, there is no single, comprehensive law regulating the collection and use of personal data on the federal level. Instead, there is a patchwork system of federal and state laws and regulations that can sometimes overlap or contradict one another. Thus, governmental agencies and industry groups have developed self-regulatory guidelines and frameworks or “best practices” that are increasingly being used as a tool for enforcement by regulators. Some of the most notable federal privacy laws include the following:
The Federal Trade Commission Act
The Financial Services Modernization Act
The Health Insurance Portability and Accountability Act
The Fair Credit Reporting Act
The Controlling the Assault of Non-Solicited Pornography and Marketing Act
Telephone Consumer Protection Act
The Children’s Online Privacy Protection Act
The Electronic Communications Privacy Act
The Judicial Redress Act
In October 2016, under the Obama administration, the Federal Communications Commission (FCC) adopted a set of privacy rule for broadband ISP providers that established a framework of customer consent required for ISPs to use and share their customers’ personal information that was calibrated to the sensitivity of the information. The rules would have incorporated the controversial inclusion of browsing history and apps usage as sensitive information, requiring opt-in consent. They also would have included data security and breach notification requirements. The Federal Trade Commission (FTC), which oversees consumer privacy compliance for other companies, does not currently treat consumer browsing history or apps usage as sensitive data.
On April 3rd, 2017, President Donald Trump signed into law a bill that repealed those privacy and data security regulations. Given the pervasive amount of user information that is collected, stored, and shared, (1) do you think Internet browser history and app usage should be considered “sensitive data,” and if so, (2) should the FCC Privacy Policy Rule have been repealed? Discuss why the United States has been reluctant to pass comprehensive broad data and privacy protection laws.
