HIPAA seems comparable but only applies to medical data, but is there anything more general than that?
How does privacy act compare to data subject access rights under gdpr? Is it that it only applies to government entities but not private sector data controllers?
HIPAA seems comparable but only applies to medical data, but is there anything more general than that?
Not really, at least at the national level.
There is no comprehensive national regulation of data privacy in the United States. There are regulations related to health information (HIPAA), to educational records, to tax information, to census information, credit reporting agencies, and to banking records (as well, of course, as to national security information). There are also largely consistent restrictions at the state level related to the juvenile justice process.
But data privacy is not a subject of general regulation in the U.S.
Instead, the data privacy regulations of the U.S. consist of a patchwork of fragmentary state and federal laws and regulations, superimposed on a significant and not entirely consistent or well developed body of common law precedents such as the privacy torts set forth in the Restatement (Second) of Torts, which some states have adopted fully, some states have rejected almost completely, and some states have adopted in part or with significant modifications.
The U.S. Constitutional law of the First Amendment also heavily colors how other legal limitations and authorizations are construed and drafted, because the right to distribute truthful information without restriction has long been considered one of the core protections of the First Amendment, even in the much less vigorously protected area of commercial speech.
Some states have more general regulations, and the most important of these is California, both because it is a large and economically significant state, and because it is the home to many of the leading U.S. technology companies, many of which expressly adopt of the law of the State of California in choice of law clauses in their terms of service and contracts.
The California law most similar to the GDPR is the California Consumer Privacy Act of 2018 (CCPA) which gives consumers rights with respect to the use of the personal information that businesses collect about them and the CCPA regulations that provide guidance on how to implement the law. The website of the State of California's attorney general provides some answers to frequently asked questions about this law.
