US and International Data Privacy Law

Why Data Privacy Law Matters for Analytics Professionals

Every time a data analyst builds a model, cleans a dataset, or publishes a dashboard, they are handling information about real people. Mishandling that information can harm individuals, expose organizations to substantial penalties, and destroy public trust. Privacy law is not just a compliance checkbox — it is a professional obligation. As an analyst, you must know which laws govern your data before you write a single line of code or run a single query.

The General Structure of US Privacy Law

The United States does not have a single, comprehensive federal privacy statute. Instead, protection is organized by sector (health, education, children) and by state. Federal agencies such as the Federal Trade Commission (FTC) enforce baseline rules against deceptive or unfair data practices. On top of federal floors, some states — most notably California — have enacted broad consumer-privacy laws. International partners such as the European Union have their own frameworks that reach US organizations when those organizations handle EU residents' data.

HIPAA — Health Insurance Portability and Accountability Act

HIPAA applies to covered entities (health plans, healthcare clearinghouses, most healthcare providers) and their business associates (any vendor or contractor that creates, receives, maintains, or transmits protected health information on their behalf). The key protected category is Protected Health Information (PHI) — individually identifiable health data in any form, including electronic (ePHI).

Core requirements for analysts:

• Use the minimum necessary standard: access only the data elements needed for the specific task.
• De-identification must follow one of two approved methods — the Expert Determination method or the Safe Harbor method (removing 18 specific identifiers).
• Security Rule controls apply to ePHI: access controls, audit logs, encryption in transit and at rest.
• Penalties range by level of culpability from relatively modest civil fines up to substantial criminal penalties for knowing violations. Consult the current HHS penalty tiers for exact figures.

FERPA — Family Educational Rights and Privacy Act

FERPA protects education records — records directly related to a student that are maintained by an educational agency or institution receiving federal funding. Parents hold rights until the student turns 18, after which rights transfer to the student.

Core requirements for analysts:

• Education records may not be disclosed to third parties without written consent, with exceptions for school officials with a legitimate educational interest, research studies under specific agreements, and others listed in the statute.
• Analysts building dashboards or predictive models for K–12 or higher-education institutions must verify that any data sharing or external storage meets FERPA's requirements.
• There is no private right of action under FERPA; enforcement is through the US Department of Education, which can withdraw federal funding.

COPPA — Children's Online Privacy Protection Act

COPPA, enforced by the FTC, applies to operators of websites or online services directed to children under 13, or any operator with actual knowledge that it is collecting personal information from children under 13.

Core requirements for analysts:

• Obtain verifiable parental consent before collecting personal information from children under 13.
• Provide a clear and complete privacy notice.
• Allow parents to review and delete their child's information.
• Retain children's data only as long as necessary.
• Data analysts working on engagement models or recommendation systems for platforms used by children must flag COPPA applicability immediately.

CCPA and CPRA — California Consumer Privacy Act and California Privacy Rights Act

The CCPA (effective 2020) gave California consumers significant rights over their personal information. The CPRA (effective 2023) strengthened and expanded those rights and created the California Privacy Protection Agency (CPPA) to enforce the law.

CCPA/CPRA applies to for-profit businesses meeting certain thresholds (annual revenue, volume of consumers' personal information processed, or revenue derived from selling personal information — check the current statutory thresholds, as they may be updated).

Key consumer rights:

• Right to know what personal information is collected and how it is used.
• Right to delete personal information, with exceptions.
• Right to opt out of the sale or sharing of personal information.
• Right to correct inaccurate personal information (added by CPRA).
• Right to limit use of sensitive personal information (added by CPRA).
• Right to non-discrimination for exercising these rights.

For analysts, this means data pipelines must be designed to honor deletion requests and data-subject access requests within the statutory timeframes, and data inventories must be maintained to respond accurately.

GDPR — EU General Data Protection Regulation

The GDPR is EU law, but it has extraterritorial reach: it applies to any organization — including US companies — that processes personal data of EU residents in connection with offering goods or services to them, or monitoring their behavior.

Key principles: lawfulness, fairness, transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability.

Lawful bases for processing include consent, contract, legal obligation, vital interests, public task, and legitimate interests. Analytics work most often relies on consent or legitimate interests, both of which require careful documentation.

Data-subject rights under GDPR include the right to access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and the right to object to automated decision-making including profiling.

Penalties under GDPR can be substantial — the regulation specifies two tiers of maximum fines based on a percentage of global annual turnover. Consult current GDPR text for exact figures, as enforcement decisions evolve.

Safety and Professional Responsibility

Data privacy law is a professional safety system for the people whose data you handle. Treat a privacy obligation the way a technician treats a lockout/tagout procedure: do not skip steps because they seem inconvenient. Before starting any analytics project, complete a data inventory, identify all applicable regulations, document your legal basis for processing, and involve your organization's privacy officer or legal counsel when in doubt. Breaching privacy law does not only harm your employer — it can cause real harm to real people.