HIPAA seems comparable but only applies to medical data, but is there anything more general than that?

How does privacy act compare to data subject access rights under gdpr? Is it that it only applies to government entities but not private sector data controllers?

1 Answer 1


HIPAA seems comparable but only applies to medical data, but is there anything more general than that?

Not really, at least at the national level.

There is no comprehensive national regulation of data privacy in the United States. There are regulations related to health information (HIPAA), to educational records, to tax information, to census information, credit reporting agencies, and to banking records (as well, of course, as to national security information). There are also largely consistent restrictions at the state level related to the juvenile justice process.

But data privacy is not a subject of general regulation in the U.S.

Instead, the data privacy regulations of the U.S. consist of a patchwork of fragmentary state and federal laws and regulations, superimposed on a significant and not entirely consistent or well developed body of common law precedents such as the privacy torts set forth in the Restatement (Second) of Torts, which some states have adopted fully, some states have rejected almost completely, and some states have adopted in part or with significant modifications.

The U.S. Constitutional law of the First Amendment also heavily colors how other legal limitations and authorizations are construed and drafted, because the right to distribute truthful information without restriction has long been considered one of the core protections of the First Amendment, even in the much less vigorously protected area of commercial speech.

Some states have more general regulations, and the most important of these is California, both because it is a large and economically significant state, and because it is the home to many of the leading U.S. technology companies, many of which expressly adopt of the law of the State of California in choice of law clauses in their terms of service and contracts.

The California law most similar to the GDPR is the California Consumer Privacy Act of 2018 (CCPA) which gives consumers rights with respect to the use of the personal information that businesses collect about them and the CCPA regulations that provide guidance on how to implement the law. The website of the State of California's attorney general provides some answers to frequently asked questions about this law.

  • 1
    Really sorry, but I think you have actually misunderstood my question. It is more about data access than data privacy. Actually now that I think about it, the Privacy Act seems to come to mind but does it only apply to data held about a subject by government institutions? In gdpr esque terms, private sector data controllers would be exempt? Jun 11, 2022 at 0:17
  • 1
    @JosephP. I don't think we have many laws related to personal data access. The only one that comes to mind is access to your credit report, and the right to get errors in it corrected.
    – Barmar
    Jun 11, 2022 at 13:46
  • Surely the privacy and freedom of information acts come close? Jun 11, 2022 at 14:21
  • 1
    @JosephP FOIA and open records acts are restricted to government documents of the enacting jurisdiction.
    – ohwilleke
    Jun 13, 2022 at 17:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .