Privacy & Information Security Law Blog

The Centre for Information Policy Leadership (“CIPL”) at Hunton Andrews Kurth LLP has issued a white paper on Ten Principles for a Revised U.S. Privacy Framework (the “White Paper”). CIPL believes that the use of personal information and privacy can most effectively be regulated at the federal level, and puts forward ten principles that should be included in any new federal privacy framework to ensure appropriate protection for consumers while facilitating the digital economy, innovation and the responsible use of data.

The ten principles are:

1. Accountability: As a key building block of modern data protection, a federal privacy law should require organizations to implement accountability-based comprehensive privacy programs, either independently or through formal accountability schemes. Accountability should also be positively incentivized in any new U.S. privacy framework.
2. Risk-based Approach: A revised U.S. privacy framework should be based on a flexible risk-based approach(with a focus on harm prevention) that enables calibrating legal requirements and compliance measures to actual risks to individuals associated with any given uses of personal information.
3. Innovative and Contextual Transparency: A new U.S. privacy framework should seize the opportunity to set a new standard for transparency that is user-centric, contextual and tailored to specific data uses and audiences, while moving away from traditionally long, overly complex and legalistic privacy notices that are effectively meaningless to individuals.
4. Individual Empowerment: Empowering individuals in today’s digital landscape is vastly different from a time when choice and consent played a prominent role in providing control. A new U.S. law should include a robust set of individual rights, allow for choice and consent in contexts where they are still effective and otherwise empower individuals through a range of other accountability measures, such as anonymization, complaint handling and redress, and access and correction mechanisms.
5. Controller/Processor Distinction: A new federal privacy law should distinguish between the obligations of “controllers” who collect and determine the uses of personal information and processors who provide some service with respect to personal information on behalf of controllers. This will not only eliminate confusion around statutory requirements in data transactions but align the U.S. approach with existing sectoral laws that incorporate the concept (e.g., HIPAA) and international privacy laws where distinguishing such roles is now commonplace.
6. Global Interoperability: The U.S. should design its revised privacy framework in a way that harmonizes as much as appropriate with key concepts in major non-U.S. privacy laws to maximize interoperability between different legal and privacy regimes. This does not require implementing the same law in every country; rather, it means an approach that facilitates the responsible movement of data across borders, streamlines business and compliance across regions and supports the continued growth of the digital ecosystem.
7. Supportive of Responsible Innovation: A revised U.S. privacy framework should support and reward responsible innovation that takes into account privacy issues, effectively manages associated risks and ensures that data is used in an accountable way. It must not impose unnecessarily restrictive rules on any particular types of technology and must facilitate the use of data for the benefit of both society and individuals.
8. Oversight and Smart Regulation: In enumerating regulatory powers and obligations under a new framework, the law should place emphasis on and prioritize regulatory leadership and engagement and collaboration with organizations ahead of enforcement (for instance, through incentivizing organizational accountability and the development of innovative regulatory policy).
9. Effective Enforcement: While a federal privacy framework should include sensible and meaningful penalties for violations, the law should enable and prioritize alternative approaches to traditional enforcement. Penalties and fines should be proportionate to the harm, take into account relevant company characteristics such as size and revenue, be mitigated upon demonstrated accountability and compliance efforts, and should only be a last resort for negligent, willful or systematic failures.
10. Comprehensive and Harmonized Framework: The U.S. should craft an approach that will capitalize on the large U.S. digital market and that provides regulators and organizations with consistent rules and legal certainty, as well as uniformly strong privacy protections for consumers, irrespective of the state or industry. Such an approach must aim to preempt a patchwork of inconsistent state laws as well as harmonize federal U.S. sectoral laws to avoid a balkanized approach to U.S. data regulation.

Download the full paper to read more about the principles and why these are essential for inclusion in a new federal U.S. privacy framework.