I. Privacy Law Beyond the Health Sector

Most U.S. privacy law has two features that distinguish it from privacy law in other countries: U.S. law is sectoral and it is based on a “consumer protection” model. By contrast, in most other jurisdictions, personal information is safeguarded by omnibus laws rooted in a “data protection” model. The likely reasons for these differences include cultural influences and divergent constitutional treatment of rights to both privacy and free expression. Whatever its origins, the broad difference is widely understood.^{Reference McGeveran19}

Much of U.S. privacy law is narrow, with particular statutes regulating a single industry, type of technology, or population. So, for example, the Gramm-Leach Bliley Act governs handling of personal data in the financial sector, the Video Privacy Protection Act protects privacy for customers at video rental or streaming services, and the Children's Online Privacy Protection Act regulates children's online personal information. In other words, most U.S. statutes are tailored to address a particular harm within a particular context. To date, most traditional entities operating within areas like health care or biomedical research were also regulated in ways unique to that sector. HIPAA, the Common Rule, and GINA are classic examples of such sectoral statutes. HIPAA applies only to patients' personal health information when handled by specific “covered entities” — such as physicians, hospitals, or insurance companies — and their “business associates.” The Common Rule regulates only the treatment of human subjects in federally sponsored research. GINA prohibits collection of and reliance on genetic information in specified circumstances related to health insurance and employment.

Outside of the health sector, a “consumer protection” model dominates U.S. privacy law.^{Reference McGeveran20} The consumer protection model provides a system of negative rights — data collection and processing are generally allowed unless a practice is specifically banned. These laws also tend to assume a commercial relationship between the data subject and the organization collecting or processing data. Most U.S. statutes (although not all, as we shall see, particularly in the health sector) fall within the frame of consumer protection.

The “data protection” model dominant in other countries — and in U.S. health privacy law — is more restrictive than the consumer protection model. Data protection laws generally ban collection and processing of personal data unless explicitly permitted. The data protection model is founded on the notion that privacy rights over personal information are inherent human rights, regardless of the nature of the transaction involved.²¹ Accordingly, regulations developed under the data protection model provide affirmative individual rights. Under data protection laws such as the European Union's GDPR, individuals must consent to collection, use, or further distribution of personal data in many cases, and they also have the right of access to the data and ongoing rights to demand correction or deletion of information in many circumstances. Data protection laws also tend to be omnibus statutes enforced by a single national data protection regulator across all sectors, including government, nonprofit organizations, private companies — and health care institutions involved in either clinical care or research.

The closest thing the U.S. has to a broad-based privacy regulator like those in other countries is the Federal Trade Commission (FTC). Exercising its consumer protection powers under Section 5 of the Federal Trade Commission Act, the FTC serves as a backstop to narrowly tailored sectoral privacy laws. Section 5 authorizes the FTC to bring enforcement actions against “unfair and deceptive acts or practices” in interstate commerce. Thus, the FTC may institute an enforcement action when a business fails to implement or maintain reasonable privacy and security practices. Deceptive acts or practices occur when an entity makes misleading statements about its activities, such as when it violates its own privacy policies or other public comments concerning its handling of personal data. When alleging unfairness actions, the FTC must satisfy a three-prong test and allege that the practice: “(1) causes or is likely to cause substantial injury to consumers (2) which is not reasonably avoidable by consumers themselves and (3) [is] not outweighed by countervailing benefits to consumer or to competition.”²²

There are limits on the FTC's enforcement authority. First, the Commission's authority under the FTC Act applies only to matters “in or affecting commerce” by companies that are “organized to carry on business for [their] own profit or that of [their] members.”²³ Thus, the Commission does not have enforcement authority over government entities or most legitimate non-profit organizations. Additionally, the jurisdictional scope is subject to certain sector specific exemptions, such as banks and common carriers.²⁴ Aside from these carve-outs, however, the Commission has rather sweeping authority to pursue enforcement actions against unfair and deceptive acts or practices. As a result, while certainly not the same as a data protection regulator in other countries, the FTC does exercise oversight over handling of personal data in a broad swath of American institutions. Importantly here, the healthcare sector and health information are within the scope of the Commission's enforcement authority, and the FTC has brought actions against health care entities for Section 5 violations.²⁵

Second, the FTC ordinarily cannot seek financial penalties against first-time offenders for direct Section 5 violations in privacy cases.^{Reference Hoofnagle26} Rather, the FTC will negotiate a consent decree with the subject that binds it to certain compliance measures for typically twenty years. Then, if the FTC determines that a company has violated the terms of its consent decree, the FTC can seek to impose significant financial fines for the consent decree violation. For example, the FTC's recent privacy and data security settlement order of Facebook is enforcing a 2012 consent decree previously reached with the company, in addition to Section 5 itself.^{Reference Bartz27} This differs from the regulatory penalties under health and genetic privacy laws: HIPAA includes potential civil and criminal penalties on a first offense; the Common Rule authorizes the Office of Human Research Protections to terminate an entity's Institutional Review Board registration, which is likely to result in a loss of research funding; and GINA authorizes civil penalties (and in some cases private lawsuits against employers who violate the Act's employment protections).

Every state also has some form of general consumer protection law, commonly known as Unfair and Deceptive Acts or Practices (UDAP) statutes, although they vary in scope and strength from state to state.^{Reference Carter28} These statutes typically echo the FTC's prohibitions of unfair and deceptive practices, and they generally empower state attorneys general to seek civil penalties, injunctive relief, and attorneys' fees and costs.^{Reference Citron29} Many authorize individual and class action lawsuits as well. A few other state laws, such as the Illinois Biometric Information Privacy Act, impose additional restrictions on narrower classes of personal information, potentially including genetic data.

A new wave of privacy proposals at the state level seek to move somewhat beyond existing consumer protection laws such as UDAP statutes. The most prominent of these is the California Consumer Privacy Act (CCPA), which was signed into law in June 2018 and will take effect in 2020. Once in force, it will be the most stringent and expansive general privacy law in the U.S. The CCPA applies to any business that processes the “personal information” of California residents if the business exceeds one of three thresholds concerning size (earning more than $25 million gross revenue annually), volume of personal data (handling personal information concerning 50,000 or more consumers, households, or devices annually for commercial purposes), or primary function as a data broker (deriving fifty percent or more of its annual revenues from selling personal information). While these definitions will exclude many entities handling genetic and genomic information, it also could include many, especially private companies.

The CCPA has prompted similar bills at the state and federal level. Such measures were debated in over a dozen states in the last year, and a number of other states formed task forces to explore similar bills. For example, right after the CCPA was enacted a very similar bill was introduced in the New Jersey legislature.³⁰ This bill explicitly creates a right to opt out from third-party data sales, and it mandates disclosures about data handling practices. A CCPA-like bill passed through the Washington State Senate by a bipartisan vote in 2019 before dying in the lower house.³¹ At the federal level, bills introduced in both houses of Congress have resembled the broad rights and requirements imposed by the GDPR and the CCPA. For example, Representative Suzan DelBene (D-WA) introduced a proposal that would mandate opt-in consent for the collection, storage, processing, or transfer of “sensitive” data — explicitly calling out genetic data is as a type of sensitive personal information.³² These are just a few examples of many legislative attempts demonstrating a trend to broaden the U.S. privacy framework beyond the sectoral approach. Many of these broad privacy statutes contain carve-outs to exclude health care entities, but as discussed further below, the scope and effectiveness of such exemptions vary.

Another trend present in recently enacted and proposed general privacy laws is a shift toward a broader definition of personal data. The GDPR, for one, includes not only information that specifically identifies a person but also any information that renders that person “identifiable.” The GDPR directs covered entities to make the determination of whether a person is identifiable by taking account of “all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly.” Expanding this definition even more, the CCPA includes all information that “identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”³³ This further includes inferences that may be drawn from any “personal information” to create a profile about a consumer. The California Legislature has considered proposals to narrow the CCPA's definition of personal information, but as of this writing almost all of its broad language remains intact.³⁴ The New Jersey bill noted above echoes the CCPA's expansive definition of personal information.³⁵ Applying even more broadly, the Washington Privacy Act would cover “any information that is linked or reasonably linkable to an identified or identifiable natural person” that had not been deidentified or made publicly available.³⁶ These examples are just a few of many demonstrating a trend to expand the definition of personal information beyond the narrow view of personally identifiable information found in older statutes.

II. How General Laws Treat Genomic Data

While not narrowly tailored to address the health sector or genomics specifically, the laws discussed above cast a wide net, potentially encompassing the collection and processing of genetic data, even if they do not do so explicitly (or even intentionally at times). This part addresses such laws' treatment of genetic data and considers scenarios in which the general-purpose privacy laws may apply to translational genomics.