Managing the Privacy Risks Associated with Data Outsourcing

Where Are the Risks?

Legislation currently pending in Congress could impose more uniform federal data privacy protections. Currently, however, unlike the European Union, Canada, and many other countries that have taken a centralized, national approach to data privacy regulation, the United States continues to take a sectoral approach, with different rules for different types and sources of personal information, and myriad inconsistent state laws. Financial information may be governed by credit reporting, banking, identity theft prevention and other financial privacy laws; health information may be governed by Department of Health and Human Services rules implementing HIPAA and HITECH; consumer information often falls under the jurisdiction of the Federal Trade Commission; and personal information derived from telephone or cable television records may be governed by Federal Communications Commission rules. In the event of a breach of personally identifiable information, such as Social Security Numbers, account numbers, dates of birth, and physical and virtual addresses, multiple state laws requiring notification to affected individuals are likely to apply. Certain types of data, such as consumer credit reports, are required by law to be destroyed when no longer in use. The list of privacy-related obligations goes on, and is growing.