DATA PROTECTION LAWS OF THE WORLD United States Downloaded: 31 August 2022  DATA PROTECTION LAWS OF THE WORLD Data Protection Laws of the World United States 2| | |www.dlapiperdataprotection.comUNITED STATES Last modified 24 January 2022 LAW United States privacy law is a complex patchwork of national, state and local privacy laws and regulations. There is no comprehensive national privacy law in the United States. However, the US does have a number of largely sector-specific privacy and data security laws at the federal level, as well as many more privacy laws at the state (and local) level. Federal and State Privacy Laws and Regulations Federal laws and regulations include those that apply to financial institutions, telecommunications companies, credit reporting agencies and healthcare providers, as well as driving records, children’s privacy, telemarketing, email marketing and communications privacy laws.  There are also a number of state privacy and data security laws that overlap with federal law—some of these state laws are preempted in part by federal laws, but others are not.  US states have also passed privacy and data security laws and regulations that apply across sectors and go beyond federal law—such as data security laws, secure destruction, Social Security number privacy, online privacy, biometric information privacy, and data breach notification laws. Generally, each state’s laws apply to personal information about residents of that state or activities that occur within that state. Thus, many businesses operating in the United States must comply not only with applicable federal law, but also with a number of state privacy and security laws and regulations. For example, California alone has more than 25 state privacy and data security laws, including the recently enacted California Consumer Privacy Act (CCPA), which introduced sweeping definitions and broad individual rights, and imposed substantial requirements and restrictions on the collection, use and disclosure of personal information. While the CCPA was the first cross-sector, comprehensive privacy law in the United States, several others have since been passed—including the California Consumer Privacy Rights Act (CPRA), which takes effect January 1, 2023 and substantially amends the CCPA, expanding consumer rights and imposing additional compliance obligations and restrictions related to the personal information about California residents. The CPRA also established a new California enforcement agency, which is expected to lead to increased enforcement.  Beyond California, both Virginia and Colorado have enacted new comprehensive state privacy laws that take effect in 2023—the Virginia Consumer Data Protection Act (effective January 1, 2023) the Colorado Privacy Act (effective July 1, 2023), respectively. While not identical, the Colorado and Virginia laws are substantially similar to each other.  Further, both are also generally inapplicable to personal information collected about employees and business relationships. On the other hand, while the CPRA has some practical similarities with the Colorado and Virginia laws, it adopts definitions, requirements and restrictions that vary considerably from these laws, and also, notably, applies to personal information collected from California residents in employment and B2B contexts. More information from DLA Piper on the CCPA and related issues is available at . https://www.dlapiper.com/en/us/focus/ccpa/ In addition, a number of other US states have proposed state-level privacy legislation (including Florida, Maryland, and Oklahoma). Thus, it is highly possible that additional state-level privacy laws will be enacted in the US in 2022.  DATA PROTECTION LAWS OF THE WORLD Data Protection Laws of the World United States 3| | |www.dlapiperdataprotection.comEnforcement of Unfair and Deceptive Trade Practices In the United States, consumer protection laws, which prohibit unfair and deceptive business practic