Privacy law is a broad category of statutes, constitutional principles, and common law precedents related to an individual's right to privacy and reasonable expectation of privacy. While the Universal Declaration of Human Rights and International Covenant on Civil and Political Rights assert that every person possesses the right to privacy, different countries have a wide range of approaches to regulating privacy, from the highly developed General Data Protection Regulation (GDPR) in the European Union to countries that have few or no explicitly-defined privacy laws.
Laws related to privacy may deal with information privacy, bodily or physical privacy (related to bodily integrity), privacy of the home and property, privacy of communications (secrecy of correspondence), and privacy of thought (related to intellectual freedom). Information privacy laws govern the collection, storage, and use of personal information by governments, companies, organizations, and individuals. These laws protect personal and confidential details, including names, addresses, and contact information, as well as sensitive data such as health records (medical privacy) and financial information.
Privacy laws have evolved to address emerging challenges, with significant milestones including the Privacy Act of 1974 in the U.S. and the European Union's Data Protection Directive of 1995. Today, international standards like the GDPR set global benchmarks, while sector-specific regulations like HIPAA and COPPA complement state-level laws in the U.S. In Canada, PIPEDA governs privacy, with recent case law shaping privacy rights. Digital platform challenges underscore the ongoing evolution and compliance complexities in privacy law.
A challenging issue is handling aerial drone technology within privacy laws.Rebecca L. Scharf, Drone Invasion: Unmanned Aerial Vehicles and the Right to Privacy, INDIANA LAW JOURNAL Vol. 94, 2019
International legal standards on privacy
Asia-Pacific Economic Cooperation The Asia-Pacific Economic Cooperation (APEC) introduced a voluntary Privacy Framework in 2004, which all 21 member economies adopted. This framework aims to enhance general information privacy and facilitate the secure transfer of data across borders. It comprises nine Privacy Principles, serving as minimum standards for privacy protection, including measures to prevent harm, provide notice, limit data collection, ensure personal information is used appropriately, offer choice to individuals, maintain data integrity, implement security safeguards, allow access and correction of personal information, and enforce accountability.
In 2011, APEC established the APEC Cross Border Privacy Rules System to balance the flow of information and data across borders, which is crucial for fostering trust and confidence in the online marketplace. This system builds upon the APEC Privacy Framework and incorporates four agreed-upon rules, which involve self-assessment, compliance review, recognition/acceptance, and dispute resolution and enforcement.
Council of Europe Article 8 of the European Convention on Human Rights, established by the Council of Europe in 1950 and applicable across the European continent except for Belarus and Kosovo, safeguards the right to privacy. It asserts that "Everyone has the right to respect for his private and family life, his home and his correspondence." Through extensive case law from the European Court of Human Rights in Strasbourg, privacy has been clearly defined and universally recognized as a fundamental right.
Furthermore, the Council of Europe took steps to protect individuals' privacy rights with specific measures. In 1981, it adopted the convention for the protection of individuals with regard to automatic processing of personal data. Additionally, in 1998, the Council addressed privacy concerns related to the internet by publishing "Draft Guidelines for the protection of individuals with regard to the collection and processing of personal data on the information highway," developed in collaboration with the European Commission. These guidelines were formally adopted in 1999.
European Union (EU) The 1995 Data Protection Directive (officially Directive 95/46/EC) acknowledged the authority of national data protection authorities and mandated that all Member States adhere to standardized privacy protection guidelines. These guidelines stipulated that Member States must enact stringent privacy laws consistent with the framework provided by the Directive. Moreover, the Directive specified that non-EU countries must implement privacy legislation of equivalent rigor to exchange personal data with EU countries. Additionally, companies in non-EU countries wishing to conduct business with EU-based companies must adhere to privacy standards at least as strict as those outlined in the Directive. Consequently, the Directive has influenced the development of privacy legislation beyond European borders. The proposed ePrivacy Regulation, intended to replace the Privacy and Electronic Communications Directive 2002, further contributes to EU privacy regulations.
On 25 May 2018, the General Data Protection Regulation superseded the Data Protection Directive of 1995. A significant aspect introduced by the General Data Protection Regulation is the recognition of the "right to be forgotten," which mandates that any organization collecting data on individuals must delete the relevant data upon the individual's request.Kocharyan, Hovsep, Vardanyan, Lusine, Hamuľák, Ondrej; Kerikmäe, Tanel (2021). Critical Views on the Right to Be Forgotten After the Entry into Force of the GDPR: Is it Able to Effectively Ensure Our Privacy?. International and Comparative Law Review, 21(2), 2021. 96-115. https://doi.org/10.2478/iclr-2021-0015 The Regulation drew inspiration from the European Convention on Human Rights mentioned earlier.
Organization for Economic Co-operation and Development (OECD)
The OECD (Organisation for Economic Co-operation and Development) initiated privacy guidelines in 1980, setting international standards, and in 2007, proposed cross-border cooperation for privacy law enforcement. The UN's International Covenant on Civil and Political Rights, Article 17, protects privacy, echoed in the 2013 UN General Assembly resolution affirming privacy as a fundamental human right in the digital age. The Principles on Personal Data Protection and Privacy for the UN System were declared in 2018.
United Nations (UN) Article 17 of the International Covenant on Civil and Political Rights of the United Nations in 1966 also protects privacy: "No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks."
On 18 December 2013, the United Nations General Assembly adopted resolution 68/167 on the right to privacy in the digital age. The resolution makes reference to the Universal Declaration of Human Rights and reaffirms the fundamental and protected human right of privacy.
The Principles on Personal Data Protection and Privacy for the United Nations System were declared on 11 October 2018.
Privacy laws by country There are many privacy laws widely arranged in different countries, reflecting legal traditions and policy priorities on how confidential data should be protected. Many of these laws focus as well on the protection of personal and confidential data by individuals and the transparency of data.
Australia
The current state of privacy law in Australia includes Federal and state information privacy legislation, some sector-specific privacy legislation at state level, regulation of the media and some criminal sanctions. The current position concerning civil causes of action for invasion of privacy is unclear: some courts have indicated that a tort of invasion of privacy may exist in Australia..Alan Davidson, Social Media and Electronic Commerce Law, 2nd edition, Cambridge University Press, (2016) pp. 118–123..Jane Doe v. Australian Broadcasting Corporation VCC 281, County Court of Victoria However this has not been upheld by the higher courts, which have been content to develop the equitable doctrine of Breach of Confidence to protect privacy, following the example set by the UK. In 2008, the Australian Law Reform Commission recommended the enactment of a statutory cause of action for invasion of privacy."Invasion of privacy: penalties and remedies: review of the law of privacy: stage 3" (2009) (Issues paper 14), New Zealand Law Commission, , 2009 NZIP 14 accessed 27 August 2011 The Privacy Act 1988 aims to protect and regulate an individual's private information. It manages and monitors Australian Government and organisations on how they hold personal information.
Bahamas The Bahamas has an official data protection law that protects the personal information of its citizens in both the private and public sector: Data Protection Act 2003 (the Bahamas Law). The Bahamas Law appoints a data protection commissioner to the Office of Data Protection to ensure that data protection is being held. Even though there is legislation enforced in the Bahamas through the Data Protection Act 2003, the act lacks many enforcements since a data protection officer doesn't need to be in office nor does any group or organization need to notify the Office of Data Protection when a hacker has breached privacy law. Also, there are no requirements for registering databases or restricting data flow across national borders. Therefore, the legislation does not meet European Union standards, which was the goal of creating the law in the first place.
Belize Belize has an official privacy act which is the Data Protection Act (2021). This act regulates the usage and collection of personal data to protect individual privacy. This act establishes different data protection principles and data subjects.
Additionally, the Freedom of Information Act currently protects the personal information of the citizens of Belize. The Freedom of Information Act became effective in 1967 and is a federal law that grants any individual to access records from federal government agencies. The FOIA grants public access to businesses and organizations to be able to access federal records, but does not provide access to federal records held from the United States.
Brazil On 14 August 2018, Brazil enacted its General Personal Data Protection Law.Lei 13709 Dispõe sobre a proteção de dados pessoais e altera a Lei nº 12.965, de 23 de abril de 2014 (Marco Civil da Internet) / Law 13709 Provides for the protection of personal data and amends Law no. 12.965, of 23 April 2014 (Brazilian Civil Rights Framework for the Internet) The General Personal Data Protection Law, which is also known as Brazils Lei Geral de Proteçao de Dados Pessoais
The bill has 65 articles and has many similarities to the GDPR. The first translation into English of the new data protection law was published by Ronaldo Lemos, a Brazilian lawyer specialized in technology, on that same date.Translation of Brazil's Data Protection Law by Ronaldo Lemos There is a newer version.Version translated by Luca Belli, Lua Fergus and Laila Lorenzon, 2020
Canada In Canada, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) governs the collection, use, and disclosure of personal information in connection with commercial activities, as well as personal information about employees of federal works, undertakings and businesses. The PIPEDA brings Canada into compliance with EU data protection law, although civil society, regulators, and academics have more recently claimed that it does not address modern challenges of privacy law sufficiently, particularly in view of AI, calling for reform.