Privacy law

Privacy laws by country

There are many privacy laws widely arranged in different countries, reflecting legal traditions and policy priorities on how confidential data should be protected. Many of these laws focus as well on the protection of personal and confidential data by individuals and the transparency of data.

Australia

The current state of privacy law in Australia includes Federal and state information privacy legislation, some sector-specific privacy legislation at state level, regulation of the media and some criminal sanctions. The current position concerning civil causes of action for invasion of privacy is unclear: some courts have indicated that a tort of invasion of privacy may exist in Australia. However this has not been upheld by the higher courts, which have been content to develop the equitable doctrine of Breach of Confidence to protect privacy, following the example set by the UK. In 2008, the Australian Law Reform Commission recommended the enactment of a statutory cause of action for invasion of privacy. The Privacy Act 1988 aims to protect and regulate an individual's private information. It manages and monitors Australian Government and organisations on how they hold personal information.

Bahamas

The Bahamas has an official data protection law that protects the personal information of its citizens in both the private and public sector: Data Protection Act 2003 (the Bahamas Law). The Bahamas Law appoints a data protection commissioner to the Office of Data Protection to ensure that data protection is being held. Even though there is legislation enforced in the Bahamas through the Data Protection Act 2003, the act lacks many enforcements since a data protection officer doesn't need to be in office nor does any group or organization need to notify the Office of Data Protection when a hacker has breached privacy law. Also, there are no requirements for registering databases or restricting data flow across national borders. Therefore, the legislation does not meet European Union standards, which was the goal of creating the law in the first place.

Belize

Belize has an official privacy act which is the Data Protection Act (2021). This act regulates the usage and collection of personal data to protect individual privacy. This act establishes different data protection principles and data subjects.

Additionally, the Freedom of Information Act currently protects the personal information of the citizens of Belize. The Freedom of Information Act became effective in 1967 and is a federal law that grants any individual to access records from federal government agencies. The FOIA grants public access to businesses and organizations to be able to access federal records, but does not provide access to federal records held from the United States.

Brazil

On 14 August 2018, Brazil enacted its General Personal Data Protection Law. The General Personal Data Protection Law, which is also known as Brazils Lei Geral de Proteçao de Dados Pessoais

The bill has 65 articles and has many similarities to the GDPR. The first translation into English of the new data protection law was published by Ronaldo Lemos, a Brazilian lawyer specialized in technology, on that same date. There is a newer version.

Canada

In Canada, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) governs the collection, use, and disclosure of personal information in connection with commercial activities, as well as personal information about employees of federal works, undertakings and businesses. The PIPEDA brings Canada into compliance with EU data protection law, although civil society, regulators, and academics have more recently claimed that it does not address modern challenges of privacy law sufficiently, particularly in view of AI, calling for reform.

PIPEDA does not apply to non-commercial organizations or provincial governments, which remain within the jurisdiction of provinces. Five Canadian provinces have enacted privacy laws that apply to their private sector. Personal information collected, used and disclosed by the federal government and crown corporations is governed by the Privacy Act. Many provinces have enacted provincial legislation similar to the Privacy Act, such as the Ontario Freedom of Information and Protection of Privacy Act which applies to public bodies in that province.

There remains some debate whether there exists a common law tort for breach of privacy across Canada. There have been a number of cases identifying a common law right to privacy but the requirements have not always been articulated clearly.

In Eastmond v. Canadian Pacific Railway & Privacy Commissioner of Canada Canada's Supreme Court found that CP could collect Eastmond's personal information without his knowledge or consent because it benefited from the exemption in paragraph 7(1)(b) of PIPEDA, which provides that personal information can be collected without consent if "it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement".

Implications for Specific Sectors

Canadian privacy laws have significant implications for various sectors, particularly finance, healthcare, and digital commerce. For instance, the financial sector is strictly regulated under PIPEDA, which requires financial institutions to obtain consent for the collection, use, or disclosure of personal information. Moreover, these institutions must also provide robust safeguards to protect this information against loss or theft.

In healthcare, provinces like Alberta and British Columbia have specific laws protecting personal health information, which require healthcare providers to manage patient data with high confidentiality and security levels. This includes ensuring that patient consent is obtained before their personal health information is shared or accessed.

Case Law and Regulatory Actions

Recent case law in Canada has further defined the scope and application of privacy laws. For instance, the case of Jones v. Tsige recognized the tort of intrusion upon seclusion, affirming that individuals have a right to privacy against unreasonable intrusion. This landmark ruling has significant implications for how personal data is handled across all sectors, emphasizing the need for businesses to maintain strict privacy controls.

Interaction with International Privacy Frameworks

Canadian privacy laws also interact with international frameworks, notably the European Union's General Data Protection Regulation (GDPR). Although PIPEDA shares many similarities with GDPR, there are nuanced differences, particularly in terms of consent and data subject rights. Canadian businesses dealing with international data need to comply with both PIPEDA and GDPR, making compliance a complex but critical task

Privacy Rights and Obligations in Digital Platforms

The digital transformation has brought specific challenges and focus areas for privacy regulation in Canada. The Canadian Anti-Spam Legislation (CASL), for example, regulates how businesses can conduct digital marketing and communications, requiring explicit consent for sending commercial electronic messages. This legislation is part of Canada's efforts to protect consumers from spam and related threats while ensuring that businesses conduct their digital marketing responsibly.

The rise of digital platforms has also prompted discussions about privacy rights concerning consumer data collected by large tech companies. The Privacy Commissioner of Canada has been active in investigating and regulating how these companies comply with Canadian privacy laws, ensuring they provide transparency to users about data usage and uphold the rights of Canadian citizens

Future Directions and Compliance Challenges

Canadian privacy laws are continually evolving to address new challenges posed by technological advancements and global data flows. Businesses operating in Canada must stay informed about these changes to ensure compliance and protect the personal information of their customers effectively.

For detailed guidance and the latest updates on compliance with Canadian privacy laws, businesses and individuals can refer to resources provided by the Office of the Privacy Commissioner of Canada and stay informed about developments in Canadian privacy law through expert analyses and updates.

China

In 1995, the Computer Processed Personal Information Protection Act was enacted in order to protect personal information processed by computers. The general provision specified the purpose of the law, defined crucial terms, prohibited individuals from waiving certain rights.

The National Security Law and the Cybersecurity Law promulgated in 2015 give public security and security departments great powers to collect all kinds of information, forcing individuals to use network services to submit private information for monitoring, and forcing network operators to store user data Within China, unrestricted "technical support" from the security department must be provided. Other laws and regulations related to privacy are as follows:

Privacy of the deceased

The Supreme People's Court's "Interpretation on Several Issues Concerning the Determination of Liability for Compensation for Mental Damage in Civil Torts" was adopted at the 116th meeting of the Judicial Committee of the Supreme People's Court on February 26, 2001. Article 3 After the death of a natural person, if a close relative of a natural person suffers mental pain due to the following infringements, and the people’s court sues for compensation for mental damage, the people’s court shall accept the case: (2) Illegal disclosure or use of the privacy of the deceased, or infringement of the privacy of the deceased in other ways that violate social public interests or social ethics.

Law on the Protection of Minors

Article 39. No organization or individual may disclose the personal privacy of minors. No organization or individual may conceal or destroy letters, diaries, and e-mails of minors, except for the need to investigate crimes. Public security organs or people's procuratorates shall conduct inspections in accordance with the law, or letters, diaries, and e-mails of minors who are incapacitated. Diaries and e-mails shall be opened and read by their parents or other guardians, and no organization or individual shall open or read them.

Fiji

An archipelago located in the Pacific, the country of Fiji was founded on 10 October 1970. In its constitution, the people inhabiting the land are granted the right to privacy. The exact workings from the constitution is the following: "Every person has the right to personal privacy, which includes the right to — (a) confidentiality of their personal information; (b) confidentiality of their communications; and (c) respect for their private and family life". But in this very same constitution, it is expressed that it is possible "to the extent that it is necessary" for a law to be passed that limits or impacts the execution of the right to privacy law. Another privacy related law can be seen in section 54 of the Telecommunications Promulgation passed in 2008, which states that "any service provider supplying telecommunications to consumers must keep information about consumers confidential". Billing information and call information are no exceptions. The only exception to this rule is for the purpose of bringing to light "fraud or bad debt". Under this law, even with the consent of the customer, the disclosure of information is not permitted.

Other Privacy laws that have been adopted by this country are those that are meant to protect the collected information, cookies and other privacy-related matter of tourist. This is in regards to (but not limited to) information collected during bookings, the use of one technology of another that belongs to said company or through the use of a service of the company, or when making payments. Additionally, as a member of the United Nations, the Fiji is bound by the Universal Declaration of Human Rights which states in article twelve, "No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks".

France

France adopted a data privacy law in 1978. It applies to public and private organizations and forbids gathering sensitive data about physical persons (including sexuality, ethnicity, and political or religious opinions). The law is administered by the Commission nationale de l'informatique et des libertés (CNIL), a dedicated national administration. Like in Germany, data violations are considered criminal offenses (Art. 84 GPR with Code Pénal, Section 1, Chapitre VI, Art. 226ff.).

Germany

Germany is known to be one of the first countries (in 1970) with the strictest and most detailed data privacy laws in the world. The citizens' right to protection is stated in the Constitution of Germany, in Art. 2 para. 1, and Art. 1 para. 1. The citizens' data of Germany is mainly protected under the Federal Data Protection Act (1977) from corporations, which has been amended the most recently in 2009. This act specifically targets all businesses that collect information for its use. The major regulation protects the data within the private and personal sector, and as a member of the European Union (EU), Germany has additionally ratified its act, convention, and additional protocol with the EU according to the EU Data Protection Directive 95/46 EC.

In Germany, there are two kinds of restrictions on a transfer of personal data. Since Germany is part of the EU Member States, the transfer of personal data of its citizens to a nation outside the EEA is always subject to a decent level of data protection in the offshore country. Secondly, according to German data policy rules, any transfer of personal data outside the EEA symbolizes a connection to a third party which requires a reason. That reason may be for emergency reasons, and a provision must be met with consent by the receiver and the subject of the data. Keep in mind that in Germany, data transfers within a group of companies is subject to the same treatment as transfer to third-parties if the location is outside the EEA.

Specifically, the Federal Data Protection Commission is in charge of regulating the entirety of the enforcement of data privacy regulations for Germany. In addition, Germany is part of the Organisation for Economic Cooperation and Development (OECD). The Federal Data Protection Commission of Germany is a member of the International Conference of Data Protection and Privacy Commissioners, European Data Protection Authorities, the EU Article 29 Working Party, and the Global Privacy Enforcement Network.

Regarding the protection of children, Germany is potentially the first nation that has played an active role in banning the share of data within toys connected to Wi-Fi and the Internet, like for instance, "My Friend Cayla". The group in charge of protecting the data of children is the Federal Network Agency (Bundesnetzagentur).

Like in France, data violations are considered offenses (Art. 84 GPR with § 42 BDSG).

Greece

During the military dictatorship era the 57 AK law prohibited taking photos of people without their permission but the law has since been superseded. The 2472/1997 law protects personal data of citizens but consent for taking photos of people is not required as long as they aren't used commercially or are used only for personal archiving ("οικιακή χρήση" / "home use"), for publication in editorial, educational, cultural, scientific or news publications, and for fine art purposes (e.g. street photography which has been uphold as legal by the courts whether done by professional or amateur photographers). However, photographing people or collecting their personal data for commercial (advertising) purposes requires their consent. The law gives photographers the right to commercially use photos of people who have not consented to the use of the images in which they appear if the depicted people have either been paid for the photo session as models (so there is no separation between editorial and commercial models in Greek law) or they have paid the photographer for obtaining the photo (this, for example, gives the right to wedding photographers to advertise their work using their photos of newly-wed couples they photographed in a professional capacity). In Greece the right to take photographs and publish them or sell licensing rights over them as fine art or editorial content is protected by the Constitution of Greece (Article 14 and other articles) and free speech laws as well as by case law and legal cases. Photographing the police or children and publishing the photographs in a non-commercial capacity is also legal.

Hong Kong

In Hong Kong, the law governing the protection of personal data is principally found in the Personal Data (Privacy) Ordinance (Cap. 486) which came into force on 20 December 1996. Various amendments were made to enhance the protection of personal data privacy of individuals through the Personal Data (Privacy) (Amendment) Ordinance 2012. Examples of personal data protected include names, phone numbers, addresses, identity card numbers, photos, medical records and employment records. As Hong Kong remains a common law jurisdiction, judicial cases are also a source of privacy law. The power of enforcement is vested with the Privacy Commissioner (the "Commissioner") for Personal Data. Non-compliance with data protection principles set out in the ordinances does not constitute a criminal offense directly. The Commissioner may serve an enforcement notice to direct the data user to remedy the contravention and/or instigate the prosecution action. Contravention of an enforcement notice may result in a fine and imprisonment.

India

India's data protection law is known as The Digital Personal Data Protection Act, 2023, the Right to Privacy is a fundamental right and an intrinsic part of Article 21 that protects life and liberty of the citizens and as a part of the freedoms guaranteed by Part III of the Constitution. In June 2011, India passed subordinate legislation that included various new rules that apply to companies and consumers. A key aspect of the new rules required that any organization that processes personal information must obtain written consent from the data subjects before undertaking certain activities. However, application and enforcement of the rules is still uncertain. The Aadhaar Card privacy issue became controversial when the case reached the Supreme Court. The hearing in the Aadhaar case went on for 38 days across 4 months, making it the second longest Supreme Court hearing after the landmark Kesavananda Bharati v. State of Kerala.

On 24 August 2017, a nine-judge bench of the Supreme Court in Justice K. S. Puttaswamy (Retd.) and Anr. vs Union of India And Ors. unanimously held that the right to privacy is an intrinsic part of right to life and personal liberty under Article 21 of the Constitution.

Previously, the Information Technology (Amendment) Act, 2008 made changes to the Information Technology Act, 2000 and added the following two sections relating to Privacy:

• Section 43A, which deals with implementation of reasonable security practices for sensitive personal data or information and provides for the compensation of the person affected by wrongful loss or wrongful gain.
• Section 72A, which provides for imprisonment for a period up to three years and/or a fine up to Rs. 500,000 for a person who causes wrongful loss or wrongful gain by disclosing personal information of another person while providing services under the terms of lawful contract. A constitutional bench of the Supreme Court declared 'Privacy' as a fundamental right on 24 August 2017.

Ireland

Ireland is under the Data Protection Act 1988 along with the EU General Data Protection Regulation, which regulates the utilization of personal data. The DPA protects data within the private and personal sector. The DPA ensures that when data is transported, the location must be safe and in acknowledgement of the legislation to maintain data privacy. When collecting and processing data, some of the requirements are listed below:

• the subject of personal data must have given consent
• the data is in the subject's interest
• the reason for the processing of data is for a contract
• the reason for the processing of data is the prevention of injury

Specifically the Data Protection Commissioner oversees the entirety of the enforcement of data privacy regulations for Ireland. All persons that collect and process data must register with the Data Protection Commissioner unless they are exempt (non-profit organizations, journalistic, academic, literary expression etc.) and renew their registration annually.

Electronic Privacy Protection

Considering the protection of internet property and online data, the ePrivacy Regulations 2011 protect the communications and higher-advanced technical property and data such as social media and the telephone.

In relation to international data privacy law that Ireland is involved in, the British–Irish Agreement Act 1999 Section 51 extensively states the relationship between data security between the United Kingdom and Ireland.

In addition, Ireland is part of the Council of Europe and the Organisation for Economic Cooperation and Development.

The Data Protection Commissioner of Ireland is a member of the International Conference of Data Protection and Privacy Commissioners, European Data Protection Authorities, the EU Article 29 Working Party, Global Privacy Enforcement Network, and the British, Irish, and Islands Data Protection Authorities.

Ireland is also the main international location for social media platforms, specifically LinkedIn and Twitter, for data collection and control for any data processed outside the United States.

Israel

In the Israel privacy law, infringement of privacy is a civil wrong and many types of it constitute an offense punishable by up to 5 years of imprisonment. A considerable part of this law addresses the privacy of databases and their use for mailing.

Jamaica

The Jamaican constitution grants its people the right to "respect for and protection of private and family life, and privacy of the home". Although the government grants its citizens the right to privacy, the protection of this right is not strong. But in regards to other privacy laws that have been adopted in Jamaica, the closest one is the Private Security Regulation Authority Act. This act passed in the year 1992, establishing the Private Security Regulation Authority. This organization is tasked with the responsibility of regulating the private security business and ensuring that everyone working as a private security guard is trained and certified. The goal of this is to ensure a safer home, community, and businesses. One of the reasons as to why this law was passed is that as trained workers, the guards could ensure maximum Customer service and also with the education they received they would be equipped how best to deal with certain situations as well as avoid actions can that could be considered violations, such as invasion of privacy. Additionally, as a member of the United Nations, the Jamaica is bound by the Universal Declaration of Human Rights which states in article two "No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks".

Japan

On 30 May 2003, Japan enacted a series of laws in the area of data protection:

• The Act on the Protection of Personal Information (APPI)
• The Act on the Protection of Personal Information Held by Administrative Organs (APPIHAO)
• The Act on the Protection of Personal Information Held by Incorporated Administrative Agencies (APPI-IAA)

The two latter acts (amended in 2016) contain provisions applicable to the protection of personal information by public sector entities.

Kenya

Kenya currently does not have a strong general privacy protection law for its constituents. But in chapter 4 — The Bill of Rights, and in the second part which is titled "Rights and Fundamental Freedoms", of the constitution, privacy is allocated its own section. There we see that the Kenyan government express that all its people have the right to privacy, "which includes the right not to have — (a) their person, home or property searched; (b) their possessions seized; (c) information relating to their family or private affairs unnecessarily required or revealed, or (d) the privacy of their communications infringed". Although Kenya grants its people the right to privacy, there seems to be no existing document that protects these specific privacy laws. Regarding privacy laws relating to data privacy, like many African countries as expressed by Alex Boniface Makulilo, Kenya's privacy laws are far from the European 'adequacy' standard.

As of today, Kenya does have laws that focus on specific sectors. The following are the sectors: communication and information. The law pertaining to this is called the Kenya Information and Communication Act. This Act makes it illegal for any licensed telecommunication operators to disclose or intercept information that is able to get access through the customer's use of the service. This law also grants privacy protection in the course of making use of the service provided by said company. And if the information of the customer is going to be provided to any third party it is mandatory that the customer is made aware of such an exchange and that some form of agreement is reached, even if the person is a family member. This act also goes as far as protecting data for Kenyans especially for the use of fraud and other ill manners. Additionally, as a member of the United Nations, Kenya is bound by the universal declaration of Human Rights which states in article two "No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks".

Malaysia

After their independence from Great Britain in 1957, Malaysia's existing legal system was based primarily on English common law. The following common law torts are related to personal information privacy and continue to play a role in Malaysia's legal system: breach of confidence, defamation, malicious falsehood, and negligence. In recent years, however, the Court of Appeal in Malaysia has referred less to English common law and instead looked more toward other nations with similar colonial histories and whose written constitutions are more like the Malaysian Constitution. Unlike the courts in these other nations, such as India's Supreme Court, the Malaysian Court of Appeal has not yet recognized a constitutionally protected right to privacy.

In June 2010, the Malaysian Parliament passed the Personal Data Protection Act 2010, and it came into effect in 2013. It outlines seven Personal Data Protection Principles that entities operating in Malaysia must adhere to: the General Principle, the Notice and Choice Principle, the Disclosure Principle, the Security Principle, the Retention Principle, the Data Integrity Principle, and the Access Principle. The Act defines personal data as "'information in respect of commercial transactions that relates directly or indirectly to the data subject, who is identified or identifiable from that information or from that and other information."

A notable contribution to general privacy law is the Act's distinction between personal data and sensitive personal data, which entails different protections. Personal data includes "information in respect of commercial transactions ... that relates directly or indirectly to a data subject" while sensitive personal data includes any "personal data consisting of information as to the physical or mental health or condition of a data subject, his political opinions, his religious beliefs or other beliefs of a similar nature." Although the Act does not apply to information processed outside the country, it does restrict cross-border transfers of data from Malaysia outwards. Additionally, the Act offers individuals the "right to access and correct the personal data held by data users", "the right to withdraw consent to the processing of personal data", and "the right to prevent data users from processing personal data for the purpose of direct marketing." Punishment for violating the Personal Data Protection Act can include fines or even imprisonment.

Other common law and business sector-specific laws that exist in Malaysia to indirectly protect confidential information include:

• Official Secrets Act 1972
• Communications and Multimedia Act 1998
• Financial Services Act 2013
• Islamic Financial Services Act 2013
• Labuan Financial Services and Securities Act 2010
• Labuan Islamic Financial Services and Securities Act 2010
• Common law duty of bank confidentiality

Mexico

On 5 July 2010, Mexico enacted a new privacy package, the Federal Law on Protection of Personal Data Held by Individuals, focused on treatment of personal data by private entities. The key elements included were:

• Requirement of all private entities who gather personal data to publish their privacy policy in accordance to the law.
• Set fines for up to $16,000,000 MXN in case of violation of the law.
• Set prison penalties to serious violations.

Mauritius

A Data Protection legislation was enacted in 2017 and it took effect in 2018. The objective of the legislation was to strengthen the control and personal autonomy of a person over their personal data, in line. The law is generally invoked to settle disputes between neighbors regarding the installation and use of surveillance cameras. The law is not applicable for the exchange of personal data between government agencies. Complaints about privacy infringement is a lengthy process.

New Zealand

In New Zealand, the Privacy Act 1993 (replaced by Privacy Act 2020) sets out principles in relation to the collection, use, disclosure, security and access to personal information.

The introduction into the New Zealand common law of a tort covering invasion of personal privacy at least by public disclosure of private facts was at issue in Hosking v Runting and was accepted by the Court of Appeal. In Rogers v TVNZ Ltd, the Supreme Court indicated it had some misgivings with how the tort was introduced, but chose not to interfere with it at that stage.

Complaints about privacy are considered by the Privacy Commissioner

Nigeria

Federal Republic of Nigeria's constitution offers its constituents the right to privacy as well as privacy protection. The following can be found in the constitution pertaining to this: "The privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications is hereby guaranteed and protected". Additionally, as a member of the United Nations, Nigeria is bound by the universal declaration of Human Rights which states in article twelve "No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks". Nigeria is one of the few African countries that is building on the privacy laws. This is evident in the fact that Nine years later in the year 2008, the Cybersecurity and Information Protection Agency Bill was passed. This bill is responsible for the creation of the Cybersecurity and Information Protection Agency. This agency is tasked with the job of preventing cyberattacks and regulating the Nigerian information technology industry. Additional laws have been passed that are meant to prevent the disclosure of information without permission and the intercepting of some form of transaction with or without evil intent.

Philippines

In Article III, Section 3, paragraph 1 of the 1987 Constitution of the Philippines lets its audience know that "The privacy of communication and correspondence shall be inviolable except upon lawful order of the court, or when public safety or order requires otherwise as prescribed by law". Not only does this country grant the Filipinos the right to privacy, but it also protects its people's right to privacy by attaching consequences to the violation of it thereof. In the year 2012, the Philippines passed the Republic Act No. 10173, also known as the "Data Privacy Act of 2012". This act extended privacy regulations and laws to apply to more than just individual industries. This act also offered protection of data belonging to the people regardless of where it is stored, be it in private spheres or not. In that very same year, the cybercrime prevention law was passed. This law was "intended to protect and safeguard the integrity of computer and communications systems" and prevent them from being misused. Not only does the Philippines have these laws, but it has also set aside agents that are tasked with regulating these privacy rules and due ensure the punishment of the violators. Additionally, with the constitution, previous laws that have been passed but that are in violation of the laws above have been said to be void and nullified. Another way this country has shown their dedication in executing this law is extending it to the government sphere as well. Additionally, as a member of the United Nations, the Philippines is bound by the Universal Declaration of Human Rights which states in article two "No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks".

Russia

Applicable legislation:

1. Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, signed and ratified by the Russian Federation on 19 December 2005;
2. The Law of the Russian Federation "On Personal Data" as of 27 July 2006 No. 152-FZ, regulating the processing of personal data by means of automation equipment. It is the operator who is required to comply with that Act.

As a general rule, consent of the individual is required for processing, i.e. obtaining, organizing, accumulating, holding, adjusting (updating, modifying), using, disclosing (including transfer), impersonating, blocking or destroying of his personal data. This rule doesn't apply where such processing is necessary for performance of the contract, to which an individual is a party.

Saudi Arabia

The Kingdom of Saudi Arabia enacted the Personal Data Protection Law (PDPL) by Royal Decree No. M/19 dated 9/2/1443 AH (16 September 2021), with amendments by Royal Decree No. M/148 dated 5/9/1444 AH (27 March 2023). The law entered into force on 14 September 2023 and full compliance was required by 14 September 2024 after a one-year grace period.

The PDPL is the first comprehensive data protection law in Saudi Arabia and is enforced by the Saudi Authority for Data and Artificial Intelligence (SDAIA) until the National Data Management Office (NDMO) assumes long-term oversight. The law applies to the processing of personal data of individuals residing in Saudi Arabia by any controller or processor inside or outside the Kingdom, giving it broader extraterritorial reach than the European Union's General Data Protection Regulation.

Violations are punishable by administrative fines of up to 5 million Saudi riyals (approximately US$1.33 million), doubled for repeat offenses. Disclosure of sensitive personal data with intent to harm is punishable by imprisonment of up to two years and fines of up to 3 million Saudi riyals.

Singapore

Singapore, like other Commonwealth jurisdictions, relies primarily on common law, and the law of confidence is employed for privacy protection cases. For example, privacy can be protected indirectly through various common law torts: defamation, trespass, nuisance, negligence, and breach of confidence. In February 2002, however, the Singaporean government decided that the common law approach was inadequate for their emerging globalized technological economy. Thus, the National Internet Advisory Committee published the Model Data Protection Code for the Private Sector, which set standards for personal data protection and was influenced by the EU Data Protection Directive and the OECD Guidelines on the Protection of Privacy. In the private sector, businesses can still choose to adopt the Model Code, but in 2005 Parliament decided that Singapore needed a more comprehensive legislative privacy framework.

In January 2013, Singapore's Personal Data Protection Act 2012 came into effect in three separate but related phases. The phases continued through July 2014 and dealt with the creation of the Personal Data Protection Commission, the national Do Not Call Registry, and general data protection Rules. The Act's general purpose "is to govern the collection, use and disclosure of personal data by organisations" while acknowledging the individual's right to control their personal data and the organizations' legal needs to collect this data. It imposes eight obligations on those organizations that use personal data: consent, purpose limitation, notification, access, correction, accuracy, protection/security, and retention. The Act prohibits transfer of personal data to countries with privacy protection standards that are lower than those outlined in the general data protection rules. The Personal Data Protection Commission is responsible for enforcing the Act, which is based primarily on a complaints-based system. The punishments for violating the Act can include being ordered by the commission to stop collecting and using personal data, to destroy the data, or to pay a penalty of up to $1 million.

Singapore has also passed various sector-specific statutes that more indirectly deal with privacy and personal information, including:

• Banking Act
• Statistics Act
• Official Secrets Act
• Statutory Bodies and Government Companies Act
• Central Provident Fund Act
• Telecommunications Act

There are also more specific acts for electronically stored information:

• Spam Control Act 2007
• Electronic Transactions Act
• National Computer Board Act
• Computer Misuse Act

South Africa

The Constitution of South Africa guarantees the most general right to privacy for all its citizens. This provides the main protection for personal data privacy so far.

The Protection of Personal Information Act 2013 (POPI) was signed into act, focusing on data privacy and is inspired by other foreign national treaties like the European Union. Minimum requirements are presented in POPI for the act of processing personal data, like the fact that the data subject must provide consent and that the data will be beneficial, and POPI will be harsher when related to cross-border international data transfers, specifically with personal information.

The recording of conversations over phone and internet is not allowed without the permission of both parties with the Regulation of Interception of Communications and Provision of Communications Related Act (2002).

In addition, South Africa is part of the Southern African Development Community and the African Union.

Sri Lanka

In early 2022, Sri Lanka became the first country in South Asia to enact comprehensive data privacy legislation. The Personal Data Protection Act No. 9 of 2022, effective since 19 March 2022, applies to processing within Sri Lanka and extends extraterritorially to controllers or processors offering goods and services to individuals in Sri Lanka and/or monitoring their behavior in the country.

Sweden

The Data Act is the world's first national data protection law and was enacted in Sweden on 11 May 1973. The law was then superseded on 24 October 1998 by the Personal Data Act (Sw. Personuppgiftslagen) that implemented the 1995 EU Data Protection Directive.

Switzerland

The main legislation over personal data privacy for the personal and private sector in Switzerland is the Swiss Federal Protection Act, specifically the Data Protection Act, a specific section under the Swiss Federal Protection Act. The Data Protection Act has been enacted since 1992 and is in charge of measuring the consent of sharing of personal data, along with other legislation like the Telecommunication Act and the Unfair Competition Act. The Act generally guides on how to collect, process, store, data, use, disclose, and destruct data. The Data Inspection Board is in charge of overseeing data breaches and privacy enforcement.

Personal data must be protected against illegal use by "being processed in good faith and must be proportionate". Also, the reason for the transfer of personal data must be known by the time of data transfer. Data not associated with people (not personal data) is not protected by the Data Protection Act.

In the case of data transfer to unsafe data protection countries, these are the major regulations required by the Data Protection Act:

• Need of direct channels for data transfer
• Individual case must have consent from receivers of data
• Disclosure is accessible to public

Switzerland is a white-listed country, meaning that it is a nation that has proper levels of data protection under the surveillance by the European Commission (EU Commission). Switzerland is not under the EU Data Protection Directive 95/46 EC. However, the data protection regulations are sufficient to meet European Union (EU) regulations without being a member of the EU.

In addition, Switzerland is part of the Council of Europe and the Organisation for Economic Cooperation and Development.

The Data Inspection Board of Switzerland is a member of the International Conference of Data Protection and Privacy Commissioners, European Data Protection Authorities, the EU Article 29 Working Party, and the Nordic Data Protection Authorities.

Taiwan

The right to privacy is not explicitly mentioned in the Republic of China Constitution, but it can be protected indirectly through judicial interpretation. For example, article 12 of the Constitution states "the people shall have freedom of confidentiality of correspondence" while article 10 states "the people shall have freedom of residence and of change of residence." Along with several other articles that assert the Constitution's protection of freedoms and rights of the people, the Grand Justices are able to decide how privacy protection fits into the legal system. The Justices first made reference to privacy being a protected right in the 1992 "Interpretation of Council of Grand Justices No. 293 on Disputes Concerning Debtors' Rights," but it was not directly or explicitly declared to be a right.

In 1995, Taiwan passed the Computer-Processed Personal Data Protection Act which was influenced by the OECD Guidelines and enforced by each separate Ministry depending on their industry sector responsibility. It only protected personal information managed by government agencies and certain industries. In 2010, Taiwan enacted the Personal Data Protection Act that laid out more comprehensive guidelines for the public and private sectors and was still enforced by individual Ministries. In the 2010 Act, personal data is protected and defined as any "data which is sufficient to, directly or indirectly, identify that person", and includes data such as name, date of birth, fingerprints, occupation, medical records, and financial status, among many others.

A few other administrative laws also deal with communication-specific personal privacy protection:

• Telecommunications Act
• Communications Protection and Surveillance Act

Additionally, chapter 28 of the Criminal Code outlines punishments for privacy violations in article 315, sections 315-1 and 315–2. The sections primarily address issues of search and seizure and criminal punishment for wrongful invasion of privacy.

Finally, articles 18(I),184(I), and 195(I) of the Taiwanese Civil Code address the "personality right" to privacy and the right to compensation when one injures the "rights" of another, such as when someone uses another's name illegally.

Thailand

Thailand's unique history of being an authoritarian buffer state during the Cold War and being under the constant threat of a coup d'état means that privacy laws have so far been limited in order to preserve national security and public safety. Thailand uses bureaucratic surveillance to maintain national security and public safety, which explains the 1991 Civil Registration Act that was passed to protect personal data in computerized record-keeping and data-processing done by the government.

The legislature passed the Official Information Act 1997 to provide basic data protection by limiting personal data collection and retention in the public sector. It defines personal information in a national context in relation to state agencies. Two communication technology related laws, the Electronic Transactions Act 2001 and the Computer Crime Act 2007, provide some data privacy protection and enforcement mechanisms. Nevertheless, Thailand still lacks legislation that explicitly addresses privacy security.

Thus, with the need for a more general and all-encompassing data protection law, the legislature proposed the Personal Data Protection Bill in 2013, which is heavily influenced by the OECD Guidelines and the EU Directive. The draft law is still under evaluation and its enactment date is not yet finalized.

Ukraine

Privacy and data protection in Ukraine is mainly regulated by the Law of Ukraine No. 2297-VI 'On Personal Data Protection' enacted on 1 June 2010. On 20 December 2012 legislation was substantially amended.

Some general and sector-specific aspects of privacy are regulated by the following acts:

• The Constitution of Ukraine;
• The Civil Code of Ukraine;
• Law of Ukraine No. 2657-XII 'On Information' dated 2 October 1992;
• Law of Ukraine No. 1280-IV 'On Telecommunications' dated 18 November 2003;
• Law of Ukraine No. 80/94-BP 'On Protection of Information in the Information and Telecommunication Systems' dated 5 July 1994;
• Law of Ukraine No. 675-VIII 'On Electronic Commerce' dated 3 September 2015.

United Kingdom

As a member of the European Convention on Human Rights, the United Kingdom adheres to Article 8 of the European Convention on Human Rights, which guarantees a "right to respect for privacy and family life" from state parties, subject to restrictions as prescribed by law and necessary in a democratic society towards a legitimate aim.

However, there is no independent tort law doctrine which recognises a right to privacy. This has been confirmed on a number of occasions.

Processing of personal information is regulated by the Data Protection Act 2018, supplementing the EU General Data Protection Regulation, which is still in force (in amended form) after the UK's exit from the EU as "retained EU legislation".

• Kaye v Robertson
• Wainwright v Home Office

Data Protection Act of 2018

The Data Protection Act of 2018 is the United Kingdom's main legislation protecting personal data and how it should be collected, processed, stored and shared. In accordance to this legislature, citizens have rights such as the right to access their personal data, and the right to request their data be deleted under certain circumstances, also known as the "right to be forgotten." The Act also sets out obligations for organizations that handle personal data, including requirements for transparency in data processing, the implementation of appropriate security measures to protect data, and the need for consent from individuals before processing their data.

Privacy and Electronic Communications Regulations

The Privacy and Electronic Communications Regulations, established in 2003, gave citizens control in consent and disclosure of information in specific electronic communications including:

• marketing calls, emails, texts and faxes
• cookies and tracking technologies
• secure communications
• customer privacy as regards traffic and location data, billing, phone line identification, and directory listings.

The goal of the Privacy and Electronic Communications Regulations is to protect individuals' privacy and control over their electronic communications while promoting responsible and transparent practices by organizations that engage in electronic marketing and in the use of tracking technologies.

United Kingdom General Data Protection Regulation

The United Kingdom General Data Protection Regulation, is the domestic version of the European Union's General Data Protection Regulation (GDPR), implemented into UK law through the Data Protection Act 2018 and came into effect alongside the EU GDPR in May 2018.

UK GDPR governs data protection and privacy within the UK applying to the processing of personal data by organizations operating within the UK. It includes specific provisions tailored to the UK's legal framework and requirements.

Key aspects of the UK GDPR include:

• Data Protection - Establishes principles for the processing of citizen's personal data under the compliance of confidentiality, integrity and availability standards.
• Data Breach Notifications - Requires organizations operating within the UK to disclose any and all information regarding recent breaches to the authorities and notify all parties impacted by the breach.
• Rights of Data Accessibility - Citizens have the right to access, modify, restrict and delete personal data collected by organizations.
• Legal Basis for Data Processing - Organizations must comply with the legal obligations when processing personal data.
• Accountability and Compliance - Organizations are required to demonstrate compliance with data protection including the implementation of security measures to protect data and to conduct Data Protection Impact Assessments while maintaining records or processing activities.

The UK GDPR aims to ensure that personal data is processed legally, fairly and with full transparency while individuals are given control over the handling of their personal data.

For more information about the Privacy Laws in the United Kingdom:

For detailed guidance and the latest updates on compliance with United Kingdom privacy laws, businesses and individuals can refer to resources provided by the https://ico.org.uk/ and stay informed about developments in UK privacy law through expert analyses and updates.

United States

The U.S. Constitution does not explicitly define a right to privacy. In 1890, Louis Brandeis (later a Supreme Court justice) and another lawyer, Samuel D. Warren II, published an influential article called "The Right to Privacy" in the Harvard Law Review arguing that the United States Constitution and common law allowed for the deduction of a general "right to privacy". To help rule on various privacy-related questions, court cases have applied the Fourth Amendment right to be free of unwarranted search or seizure, the First Amendment right to free assembly, and the Fourteenth Amendment due process right.

Torts

A tort expert and Dean of the College of Law at University of California, Berkeley, William Lloyd Prosser argued in 1960 that "privacy" was composed of four separate torts, the only unifying element of which was a "right to be left alone". The four torts were:

1. Intrusion on seclusion or solitude of the plaintiff.
2. Appropriating the plaintiff's identity for the defendant's benefit (see Personality rights § United States). Appropriation of one's likeness is considered the oldest of the main American privacy torts. It involves the right to control where one's appearance and other aspects of their "likeness," such as their voice and name, appear in areas like advertising and other media. As noted by the California Jury, successful cases built on the appropriation of a person's likeness must typically involve them being harmed in some way by this usage, which was non-consensual and contributed to some benefit, often financial, to the person or company using their image.
   • A rising case for the appropriation tort in the United States appeared in the early 1900s due to companies using individuals' identities and appearances without their consent on packaging and advertisements. A particularly influential case was Roberson v. Rochester Folding Box Co., in which young woman Abigail Roberson had her image placed on a flour advertisement causing embarrassment and emotional distress. Her case against the company was rejected, leading to widespread public disapproval and the creation of New York Civil Rights Law § 50 that forbid the appropriation of individuals' images in advertisements without their consent, with an emphasis on the emotional impacts of such exploitation.
   • The tort was also influenced by the later case of Loftus v. Greenwich Lithographing Co., where Glady Loftus sought financial compensation for the usage of her image in a film advertisement distributed around New York City; this reflected a shift in the claims of appropriation cases from emotional damage to a lack of payment for the plaintiff's image being appropriated.
   • Defenses against an accusation of appropriation include the newsworthiness of the image; consent, in which the person is argued to have opted for the usage of their likeness; and their celebrity status, as this indicates they have already publicized themselves without facing emotional damage.
3. Placing the plaintiff in a false light in the public eye.
4. Breach of confidence: publicly disclosing private facts about the plaintiff. Public Disclosure of Private Facts or Publicity Given to Private Life is a tort under privacy law that protects individuals from the unauthorized dissemination of private information that is not of public concern. This tort aims to safeguard an individual's right to privacy and prevent unwarranted intrusion into their personal lives. To establish a claim for public disclosure of private facts, the following elements generally need to be proven:
   • Publication of Private Facts: The defendant must have publicized private information about the plaintiff. This publication can be through various means such as media outlets, social media, or any other public platform.
   • Information Must Be Private: The disclosed information must be of a private nature and not generally known to the public. This can include personal details about one's health, finances, relationships, or any other intimate aspects of their life.
   • Information Must Be Offensive to a Reasonable Person: The disclosed information must be offensive or embarrassing to a reasonable person. The court will assess whether a reasonable person would find the publication highly offensive and objectionable.
   • No Legitimate Public Concern: The disclosed information should not be of legitimate public concern. If the information is newsworthy or serves a public interest, it may be protected under the First Amendment, and the plaintiff may not have a valid claim.

Federal privacy laws

The Privacy Act of 1974 is foundational, establishing a code of fair information practices that govern the collection, maintenance, use, and dissemination of information about individuals that is maintained in systems of records by federal agencies. This act allows individuals to review and amend their records, ensuring personal information is handled transparently and responsibly by the government.

Enacted in 1996, the Health Insurance Portability and Accountability Act (HIPAA) protects sensitive patient health information from being disclosed without the patient's consent or knowledge. HIPAA sets the standard for protecting sensitive patient data held by health care providers, insurance companies, and their business associates.

The Federal Trade Commission plays a crucial role in enforcing federal privacy laws that protect consumer privacy and security, particularly in commercial practices. It oversees the enforcement of laws such as the Fair Credit Reporting Act, which regulates the collection and use of consumer credit information.

One of the central privacy policies concerning minors is the Children's Online Privacy Protection Act (COPPA), which requires children under the age of thirteen to gain parental consent before putting any personal information online.

Additional federal laws related to privacy include:

• Communications Act of 1934
• Fair Debt Collection Practices Act (1977)
• Right to Financial Privacy Act of 1978
• Electronic Communications Privacy Act (1986)
• Computer Fraud and Abuse Act of 1986
• Video Privacy Protection Act (1988)
• Driver's Privacy Protection Act (1994)
• Health Insurance Portability and Accountability Act of 1996 (HIPAA)
• Information Technology Management Reform Act of 1996 (Clinger–Cohen Act)
• Financial Services Modernization Act (Gramm-Leach Bliley Act, 1999)
• E-Government Act of 2002

State privacy laws

Individual states also enact their own privacy laws. The California Consumer Privacy Act is one of the most stringent privacy laws in the U.S. It provides California residents with the right to know about the personal data collected about them, the right to delete personal information held by businesses, and the right to opt-out of the sale of their personal information. Businesses must disclose their data collection and sharing practices to consumers and allow consumers to access their data and opt-out if they choose. The Act recently expanded existing consumer rights in the state in 2023, providing citizens the right to reduce the collection of data and correct false information.

Enforcement and impact

Enforcement of these laws is specific to the statutes and the authorities responsible. For instance, HIPAA violations can lead to substantial fines imposed by the Department of Health and Human Services, while the Federal Trade Commission handles penalties under consumer protection laws. State laws are enforced by respective state attorneys general or designated state agencies.

A handful of lists and databases help risk managers research U.S. state and federal laws that define liability. The Perkins Coie Security Breach Notification Chart is a set of articles (one per state) that define data breach notification requirements among U.S. states. The NCSL Security Breach Notification Laws is a list of U.S. state statutes that define data breach notification requirements.

Uzbekistan

Though the right to privacy exists in several regulations, the most effective privacy protections come in the form of constitutional articles of Uzbekistan. Varying aspects of the right to privacy are protected in different ways by different situations.

Vietnam

Vietnam, lacking a general data protection law, relies on Civil Code regulations relating to personal data protection. Specifically, the Code "protects information relating to the private life of a person." The 2006 Law on Information Technology protects personal information, such as name, profession, phone number, and email address, and declares that organizations may only use this information for a "proper purpose". The legislation, however, does not define what qualifies as proper. The 2005 Law on Electronic Transactions protects personal information during electronic transactions by prohibiting organizations and individuals from disclosing "part or all of information related to private and personal affairs ... without prior agreement." The 2010 Law on Protection of Consumers' Rights provides further protection for consumer information, but it does not define the scope of that information or create a data protection authority; additionally, it is only applicable in the private sector.

In 2015, the Vietnam legislature introduced the Law on Information Security, which ensures better information safety and protection online and in user's computer software. It took effect on 1 July 2016 and is Vietnam's first overarching data protection legislation.

Countries without official data privacy laws

Source

• Afghanistan
• Algeria
• Bahrain
• Bangladesh
• Belize
• Bolivia
• Botswana
• Burundi
• Cambodia
• Cameroon
• Central African Republic
• Comoros
• Cuba
• Djibouti
• Ecuador
• Egypt
• El Salvador
• Equatorial Guinea
• Eritrea
• Ethiopia
• Fiji
• Gambia
• Guatemala
• Guinea
• Haiti
• Iran
• Iraq
• Jordan
• Kiribati
• Kuwait
• Lebanon
• Liberia
• Libya
• Malawi
• Maldives
• Mongolia
• Mozambique
• Myanmar
• Namibia
• Nauru
• Oman
• Pakistan
• Palau
• Palestine
• Panama
• Papua New Guinea
• Rwanda
• Samoa
• Saudi Arabia
• Sierra Leone
• Somalia
• Sudan
• Syria
• Tajikistan
• Timor-Leste
• Togo
• Tonga
• Turkmenistan
• Tuvalu
• United Arab Emirates
• Uzbekistan
• Vanuatu
• Vatican (Holy See)
• Venezuela
• Zambia

Related concepts

Privacy laws focus on protecting individuals' rights to control their personal and sensitive information, while preventing unauthorized intrusion into their private lives. They encompass strict regulations governing data protection, confidentiality, surveillance, and the use of personal information by both government and corporate entities.

Trespass to land laws focus on breaches of privacy rights related to physical intrusion onto an individual's property or personal domain without consent. This involves illegal activities such as: entering an individual's residence without consent, conducting surveillance using physical methods (e.g., deploying hidden cameras), or any unauthorized entry onto the individual's property.

Negligence laws generally address situations where individuals or entities fail to exercise appropriate caution in protecting the privacy rights of others, often holding them accountable through severe penalties like heavy fines. This aims to ensure compliance and deter future violations, involving incidents such as any mishandling of sensitive data, poor security measures leading to data breaches, or any non-compliance with privacy policies and regulations.

Fiduciary laws regulate the relationships characterized by trust and confidence, where the fiduciary accepts and complies with the legal responsibility for duties of care, loyalty, good faith, confidentiality, and more when entrusted in serving the best interests of a beneficiary. In terms of privacy, fiduciary obligations may extend to professionals like lawyers, doctors, financial advisors, and others responsible for handling confidential information, as a result of a duty of confidentiality to their clients or patients.