Information privacy, data privacy or data protection laws provide a legal framework on how to obtain, use and store data of natural persons. The various laws around the world describe the rights of natural persons to control who is using their data. This includes usually the right to get details on which data is stored, for what purpose and to request the deletion in case the purpose is not given anymore.
Over 80 countries and independent territories, including nearly every country in Europe and many in Latin America and the Caribbean, Asia, and Africa, have now adopted comprehensive data protection laws. The European Union has the General Data Protection Regulation (GDPR),Adopting a Virtual Data Protection Officer Published by Dativa, June 7, 2018, retrieved June 11, 2018 in force since May 25, 2018. The United States is notable for not having adopted a comprehensive information privacy law, but rather having adopted limited sectoral laws in some areas like the California Consumer Privacy Act (CCPA).
By Jurisdiction The German state of Hessia enacted the world's first data privacy law on September 30, 1970. In Germany the term informational self-determination was first used in the context of a German constitutional ruling relating to personal information collected during the 1983 census.Vardanyan, Lusine; Hamulak, Ondrej; Kocharyan, Hovsep. "Fragmented Identities: Legal Challenges of Digital Identity, Integrity, and Informational Self-Determination" European Studies, vol. 11, no. 1, Sciendo, 2024, pp. 105-121. https://doi.org/10.2478/eustu-2024-0005Kocharyan, H., & Vardanyan, L. (2024). The Right to Be Forgotten as a Legal Instrument for Expanding Informational Self-Determination in the Digital Age? Constitutional Discourse. https://constitutionaldiscourse.com/the-right-to-be-forgotten-as-a-legal-instrument-for-expanding-informational-self-determination-in-the-digital-age/
Asia
India India passed its Digital Personal Data Protection Act, 2023 in August 2023.
China China passed its Personal Information Protection Law (PIPL) in mid-2021, and was effective from November 1, 2021. It focuses heavily on consent, rights of the individual, and transparency of data processing. PIPL has been compared to the EU GDPR as it has similar scope and many similar provisions.
Philippines In the Philippines, The Data Privacy Act of 2012 mandated the creation of the National Privacy Commission that would monitor and maintain policies that involve information privacy and personal data protection in the country. Modeled after the EU Data Protection Directive and the Asia-Pacific Economic Cooperation (APEC) Privacy Framework, the independent body would ensure compliance of the country with international standards set for data protection. The law requires government and private organizations composed of at least 250 employees or those which have access to the personal and identifiable information of at least 1000 people to appoint a Data Protection Officer that would assist in regulating the management of personal information in such entities.
In summary, the law identifies important points regarding the handling of personal information as follows: Personal information must be collected for reasons that are specified, legitimate, and reasonable. Personal information must be handled properly. Information must be kept accurate and relevant, used only for the stated purposes, and retained only for as long as reasonably needed. The law required entities to be active in ensuring that unauthorized parties do not have access to their customers' information. Personal information must be disposed in way that unauthorized third parties could not access the discarded data.
Sri Lanka
In early 2022, Sri Lanka became the first country in South Asia to enact comprehensive data privacy legislation. The Personal Data Protection Act No. 9 of 2022, effective since March 19, 2022, applies to processing within Sri Lanka and extends extraterritorially to controllers or processors offering goods and services to individuals in Sri Lanka and/or monitoring their behavior in the country.
Europe
The right to data privacy is relatively heavily regulated and actively enforced in Europe. Article 8 of the European Convention on Human Rights (ECHR) provides a right to respect for one's "private and family life, his home and his correspondence", subject to certain restrictions. The European Court of Human Rights has given this article a very broad interpretation in its jurisprudence. According to the Court's case law the collection of information by officials of the state about an individual without their consent always falls within the scope of Article 8. Thus, gathering information for the official census, recording fingerprints and photographs in a police register, collecting medical data or details of personal expenditures, and implementing a system of personal identification has been judged to raise data privacy issues. What also falls under "privacy-sensitive data" under the GDPR is such information as racial or ethnic origin, political opinions, religious or philosophical beliefs and information regarding a person's sex life or sexual orientation.What personal data is considered sensitive?
Any state interference with a person's privacy is only acceptable for the Court if three conditions are fulfilled:
The interference is in accordance with the law The interference pursues a legitimate goal The interference is necessary in a democratic society
The government is not the only entity which may pose a threat to data privacy. Other citizens, and private companies most importantly, may also engage in threatening activities, especially since the automated processing of data became widespread. The Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data was concluded within the Council of Europe in 1981. This convention obliges the signatories to enact legislation concerning the automatic processing of personal data, which many duly did.
As all the member states of the European Union are also signatories of the European Convention on Human Rights and the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, the European Commission was concerned that diverging data protection legislation would emerge and impede the free flow of data within the EU zone. Therefore, the European Commission decided to propose harmonizing data protection law within the EU. The resulting Data Protection Directive was adopted by the European Parliament and ministers from national governments in 1995 and had to be transposed into national law by the end of 1998.
The directive contains a number of key principles with which member states must comply. Anyone processing personal data must comply with the eight enforceable principles of good practice. They state that the data must be:
Fairly and lawfully processed. Processed for limited purposes. Adequate, relevant and not excessive. Accurate. Kept no longer than necessary. Processed in accordance with the data subject's rights. Secure. Transferred only to countries with adequate protection.
Personal data covers both facts and opinions about the individual. It also includes information regarding the intentions of the data controller towards the individual, although in some limited circumstances exemptions will apply. With processing, the definition is far wider than before. For example, it incorporates the concepts of "obtaining", "holding" and "disclosing".
All EU member states adopted legislation pursuant this directive or adapted their existing laws. Each country also has its own supervisory authority to monitor the level of protection.
Because of this, in theory the transfer of personal information from the EU to the US is prohibited when equivalent privacy protection is not in place in the US. American companies that would work with EU data must comply with the Safe Harbour framework. The core principles of data protected are limited collection, consent of the subject, accuracy, integrity, security, subject right of review and deletion. As a result, customers of international organizations such as Amazon and eBay in the EU have the ability to review and delete information, while Americans do not. In the United States the equivalent guiding philosophy is the Code of Fair Information Practice (FIP).
The difference in language here is important: in the United States the debate is about privacy where in the European Community the debate is on data protection. Moving the debate from privacy to data protection is seen by some philosophers as a mechanism for moving forward in the practical realm while not requiring agreement on fundamental questions about the nature of privacy.
France France adapted its existing law, "no. 78-17 of 6 January 1978 concerning information technology, files and civil liberties".More information is available on the website of the CNIL (in French only).
Germany In Germany, both the federal government and the states enacted legislation.
Switzerland While Switzerland is not a member of the European Union (EU) or of the European Economic Area (EEA), it has partially implemented the EU Directive on the protection of personal data in 2006 by acceding to the STE 108 agreement of the Council of Europe and a corresponding amendment of the federal Data Protection Act. However, Swiss law imposes less restrictions upon data processing than the Directive in several respects.See the Federal Council's Message to Parliament, BBl 2003 2101 p. 2117 et seq.
In Switzerland, the right to privacy is guaranteed in article 13 of the Swiss Federal Constitution. The Swiss Federal Data Protection Act (DPA) and the Swiss Federal Data Protection Ordinance (DPO) entered into force on July 1, 1993. The latest amendments of the DPA and the DPO entered into force on January 1, 2008.
The DPA applies to the processing of personal data by private persons and federal government agencies. Unlike the data protection legislation of many other countries, the DPA protects both personal data pertaining to natural persons and legal entities.
The Swiss Federal Data Protection and Information Commissioner in particular supervises compliance of the federal government agencies with the DPA, provides advice to private persons on data protection, conducts investigations and makes recommendations concerning data protection practices.
Some data files must be registered with the Swiss Federal Data Protection and Information Commissioner before they are created. In the case of a transfer of personal data outside of Switzerland, special requirements need to be met and, depending on the circumstances, the Swiss Federal Data Protection and Information Commissioner must be informed before the transfer is made.
Most Swiss cantons have enacted their own data protection laws regulating the processing of personal data by cantonal and municipal bodies.
United Kingdom In the United Kingdom the Data Protection Act 1998 (c 29) (Information Commissioner) implemented the EU Directive on the protection of personal data .Information Commissioner's Office - ICO It replaced the Data Protection Act 1984 (c 35). The 2016 General Data Protection Regulation supersedes previous Protection Acts. The Data Protection Act 2018 (c 12) updates data protection laws in the UK. It is a national law which complements the European Union's General Data Protection Regulation (GDPR).
North America Canada