Key Takeaways:

• Executive Orders enacted by the US President earlier this month demonstrate a heightened scrutiny over government agencies’ handling of imported personal data and an intent to address EU regulators’ long-standing concerns about data transfers to the United States.
• US regulations impose restrictions on data transfers occurring within the US, which continue to expand particularly at the state level; however, there are few limitations on exporting data outside of the US.
• The rules and obligations surrounding data transfers are focused more on the type of personal data and/or the industry sector involved rather than geography, a more common focus within the EU and the General Data Protection Regulation (“GDPR”).

Importing Data to the US

On October 7, 2022, US President Joseph Biden issued the Executive Order On Enhancing Safeguards for United States Signals Intelligence Activities. This order bars US intelligence agencies from collecting individuals’ electronic data, including emails and text messages, transferred from Europe other than for national security purposes and requires any such collection to be proportionate and necessary. This order addresses concerns raised by the European Court of Justice in 2020 about data transfers between the EU and the US violating the GDPR and implements commitments made by the United States in March to the new EU-US Data Privacy Framework. This Framework is intended to replace the EU-US Privacy Shield, created in 2016, which was struck down as being an inadequate transfer mechanism.

Companies appear to support the Framework as it enables more business transactions and data flow with Europe and brings some relief to the increasingly strict application of the GDPR’s data transfer rules. However, there remains some uncertainty about whether the order will meet the GDPR’s adequacy standard. Businesses may also continue to be reluctant to rely on the Framework as the sole legal basis for data transfers because it will almost certainly be challenged in EU courts.

The European Commission will now prepare an adequacy decision requiring input from the European Data Protection Board, which could take at least several months. While any adequacy determination will likely be contested, this joint effort by the US and EU will hopefully restore trust in the transatlantic data flow and reduce regulatory uncertainty for businesses operating in both regions, at least for the foreseeable future.

Restrictions on US Data Transfers

The US generally does not restrict data transfers to other jurisdictions. The Federal Trade Commission (“FTC”) and other US regulators often posit that data may be exported freely but federal regulations still apply to personal data after it leaves the US. For example, the FTC held that GMR Transcription Services, Inc., a medical and legal transcription company, violated the FTC Act by exporting data to transcribers in India without implementing proper security measures.

Unlike data exports, numerous restrictions are placed on data transfers within the US at the federal level. For example, there are some federal laws and regulations that impose sector-specific restrictions:

• The Children’s Online Privacy Protection Act (“COPPA”), which governs commercial websites and online services, requires businesses to obtain “verifiable parental consent” prior to the collection, use, or disclosure of personal data from individuals under the age of 13.
• The Fair Credit Reporting Act (“FCRA”), which governs the usage and disclosure of credit reports, limits the sharing of financial information with marketing affiliates and requires consumers to be given notice of the affiliate sharing along with the opportunity to opt out of such sharing.
• The FTC Act, which broadly applies to any person or entity engaged in commerce, prohibits unfair or deceptive business practices and requires companies to inform consumers if they disclose personal data to third parties.
• The Gramm-Leach-Bliley Act (“GLBA”), which governs the financial sector, restricts financial institutions from sharing their customers’ financial information with non-affiliated third parties, unless the institution has provided customers with the required notice and the opportunity to exercise their right to opt out such sharing.
• The Health Insurance Portability and Accountability Act (“HIPAA”), which governs the healthcare sector and certain protected health information, requires covered entities to obtain informed consent from individuals prior to sharing protected health information with third parties.

Some states have enacted comprehensive, industry-neutral laws that regulate the collection, use, and sharing of personal data. Many of these state laws include certain data transfer restrictions based on the type of data involved (e.g., biometric data or other particularly sensitive information) or the reason for disclosing the data (e.g., sharing personal data to third parties for purposes of targeted advertising or the accidental disclosure of personal data due to a security breach).

More states, including California, Colorado, Connecticut, Utah, and Virginia, consider the sharing of personal data with certain third parties to constitute a “sale,” leading these states to impose obligations such as providing notice to the consumers and offering them the opportunity to opt out. This year, the first enforcement action of the California Consumer Privacy Act (“CCPA”) by the California Attorney General was brought against Sephora, a cosmetics company. The Attorney General claimed that Sephora failed to disclose to consumers it was “selling”¹ their personal data and also failed to honor user requests to opt out of these “sale” transfers via a user-enabled Global Privacy Control – a browser setting that notifies websites of a user’s privacy preferences, such as not to share or sell personal data without their consent, by sending a signal to each website a user visits.²

This recent California enforcement action underscores the importance for companies to reassess and ensure they are compliant with their data protection obligations and determine whether their privacy policies and vendor contracts should be updated. Companies should also familiarize themselves with Global Privacy Controls and operationalize their websites and processes regarding data rights requests.

1. Under the CCPA, the term "sale" is defined broadly to mean either: "(A) Selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for valuable consideration; or (B) sharing orally, in writing, or by electronic or other means, a consumer's personal information with a third party, whether for valuable consideration or for no consideration, for the third party's commercial purposes."
2. For more information, visit: www.globalprivacycontrol.org/#about