Privacy law refers to the laws which deal with the regulation of personal
information about individuals which can be collected by governments and other
public as well as private organizations and its storage and use.
Privacy laws are considered in the context of an individual's privacy
rights or reasonable expectation of privacy.
Classification of privacy laws Privacy laws can be broadly classified
into: General privacy laws that have an
overall bearing on the personal information of individuals and affect
the policies that govern many different areas of information.
Specific privacy laws that are designed to regulate specific types of
information. Some examples include: Communication privacy laws
Financial privacy laws Health privacy laws
Information privacy laws Online privacy laws
Privacy in one's home International legal standards on privacy
Article 8 of the European Convention on Human Rights, which was drafted and
adopted by the Council of Europe in 1950 and meanwhile covers the whole European
continent except for Belarus and Kosovo, protects the right to respect for
private life: "Everyone has the right to respect for his private and family life,
his home and his correspondence." Through the huge case-law of the
European Court of Human Rights in Strasbourg, privacy has been defined and
its protection has been established as a positive right of everyone.
Data privacy laws are converging in the EU, helped by the National data
protection authorities and the Data Protection Directive adopted in 1995.
Article 17 of the International Covenant on Civil and Political Rights of the
United Nations of 1966 also protects privacy: "No one shall be subjected to
arbitrary or unlawful interference with his privacy, family, home or
correspondence, nor to unlawful attacks on his honour and reputation. Everyone
has the right to the protection of the law against such interference or
attacks." Privacy laws by country
= Australia = The current state of privacy law in
Australia includes Federal and state information privacy legislation, some
sector-specific privacy legislation at state level, regulation of the media and
some criminal sanctions. The current position concerning civil causes of
action for invasion of privacy is unclear: some courts have indicated that
a tort of invasion of privacy may exist in Australia; in 2008, the Australian
Law Reform Commission recommended the enactment of a statutory cause of action
for invasion of privacy. = Brazil =
A Brazilian citizen's privacy is protected by the country's constitution,
which states: The intimacy, private life, honor and
image of the people are inviolable, with assured right to indenization by
material or moral damage resulting from its violation
= Canada = In Canada, the federal Personal
Information Protection and Electronic Documents Act governs the collection,
use and disclosure of personal information in connection with
commercial activities and personal information about employees of federal
works, undertakings and businesses. It generally does not apply to
non-commercial organizations or provincial governments. Personal
information collected, used and disclosed by the federal government and
many crown corporations is governed by the Privacy Act. Many provinces have
enacted similar provincial legislation such as the Ontario Freedom of
Information and Protection of Privacy Act which applies to public bodies in
that province. There remains some debate whether there
exists a common law tort for breach of privacy. There have been a number of
cases identifying a common law right to privacy but the requirements have not
been articulated. In Eastmond v. Canadian Pacific Railway
& Privacy Commissioner of Canada Canada's Supreme Court found that CP
could collect Eastmond's personal information without his knowledge or
consent because it benefited from the exemption in paragraph 7(1)(b) of
PIPEDA, which provides that personal information can be collected without
consent if "it is reasonable to expect that the collection with the knowledge
or consent of the individual would compromise the availability or the
accuracy of the information and the collection is reasonable for purposes
related to investigating a breach of an agreement".
= China = Computer Processed Personal Information
Protection Act was enacted in 1995 in order to protect personal information
processed by computers. The general provision specified the purpose of the
law, defined crucial terms, prohibited individuals from waiving certain rights.
= France = France adopted a data privacy law in
1978. It applies to public and private organizations and forbids gathering
sensitive data about physical persons. The law is administered by the
Commission nationale de l'informatique et des libertés, a dedicated national
administration. = Greece =
Two Greek laws relevant to privacy are 57 AK and 2472/1997. As regarding
photography: Taking a picture of a person in a public
space: Requires consent. Taking a photo or video of someone or drawing them in a
painting constitutes an illegal act by itself according to Article 57 of the
Greek Civil Code even without any publication of the resulting photo,
video or drawing. The law assumes that consent has been provided silently if
the depicted person has been paid for the photography session. The law also
provides some exceptions for persons of contemporary history. Furthermore, the
law 2472/1997 also applies in many circumstances, even in photographing
political rallies in public places or in photographing the police; Greece also
requires photographers to obtain a government permit before photographing
people participating in political protests in public places.
Publishing pictures of a person in a public space: Requires consent. The
publication of photographs of identifiable police officers beating
civilians in public places may be against the law 2472/1997 and as such
these images should be turned to the authorities for review.
Commercial use of a published picture of a person in a public space: Requires
consent. = India =
In June, 2011, India passed a new privacy package that included various
new rules that apply to companies and consumers. A key aspect of the new rules
requires that any organization that processes personal information must
obtain written consent from the data subjects before undertaking certain
activities. Application of the rule is still uncertain.
Previously, the Information Technology Act, 2008 made changes to the
Information Technology Act, 2000 and added the following two sections
relating to Privacy: Section 43A, which deals with
implementation of reasonable security practices for sensitive personal data or
information and provides for the compensation of the person affected by
wrongful loss or wrongful gain. Section 72A, which provides for
imprisonment for a period up to 3 years and/or a fine up to Rs. 5,00,000 for a
person who causes wrongful loss or wrongful gain by disclosing personal
information of another person while providing services under the terms of
lawful contract. = Japan =
Act on the Protection of Personal Information was fully enacted in 2005
for the purpose to protect the rights and interests of individuals while
taking consideration of the usefulness of personal information. The law applies
to business operators that hold the personal information of 5,000 or more
individuals. = Mexico =
In July 5, 2010, Mexico passed a new privacy package focused on treatment of
personal data by private entities. The key elements included where:
Requirement of all private entities who gather personal data to publish their
privacy policy in accordance to the law. Set fines for up to $16,000,000 MXN in
case of violation of the law. Set prison penalties to serious
violations. = New Zealand =
In New Zealand, the Privacy Act 1993 sets out principles in relation to the
collection, use, disclosure, security and access to personal information.
The introduction into the New Zealand common law of a tort covering invasion
of personal privacy at least by public disclosure of private facts was at issue
in Hosking v Runting, and was accepted by the Court of Appeal. In Rogers v TVNZ
Ltd the Supreme Court indicated it had some misgivings with how the tort was
introduced, but chose not to interfere with it at that stage.
Complaints about privacy are considered by the Privacy Commissioner
= Russia = Applicable legislation:
Convention for the Protection of Individuals with regard to Automatic
Processing of Personal Data, signed and ratified by the Russian Federation on
December 19.2005; the Law of the Russian Federation “On
Personal Data” as of 27.07.2006 No. 152-FZ, regulating the processing of
personal data by means of automation equipment. It is the operator who is
required to comply with that Act. As a general rule, consent of the
individual is required for processing, i.e. obtaining, organizing,
accumulating, holding, adjusting, using, disclosing, impersonating, blocking or
destroying of his personal data. This rule doesn't apply where such processing
is necessary for performance of the contract, to which an individual is a
party. Data protection principles and
legislation in the Russian Federation On-line database of the Russian laws
Federal Service on supervising in the sphere of communications, information
technology and mass media = United Kingdom =
As a member of the European Convention on Human Rights, the United Kingdom
adheres to Article 8 ECHR, which guarantees a "right to respect for
privacy and family life" from state parties, subject to restrictions as
prescribed by law and necessary in a democratic society towards a legitimate
aim. However, there is no independent tort
law doctrine which recognises a right to privacy. This has been confirmed on a
number of occasions. Kaye v Robertson
Wainwright v Home Office = United States =
The right to privacy is not explicitly stated anywhere in the Bill of Rights.
The idea of a right to privacy was first addressed within a legal context in the
United States. Louis Brandeis and another young lawyer, Samuel D. Warren,
published an article called "The Right to Privacy" in the Harvard Law Review in
1890 arguing that the U.S. Constitution and common law allowed for the deduction
of a general "right to privacy". Their project was never entirely
successful, and the renowned tort expert Dean Prosser argued that "privacy" was
composed of four separate torts, the only unifying element of which was a
"right to be left alone". The four torts were:
Appropriating the plaintiff's identity for the defendant's benefit
Placing the plaintiff in a false light in the public eye
Publicly disclosing private facts about the plaintiff
Unreasonably intruding upon the seclusion or solitude of the plaintiff
For additional information on Privacy laws in the United States, see:
Health Insurance Portability and Accountability Act
Financial Services Modernization Act, 15 U.S. Code §§ 6801-6810
Final Rule on Privacy of Consumer Financial Information, 16 Code of
Federal Regulations, Part 313 Fair Credit Reporting Act, 15 U.S. Code
§§ 1681-1681u Fair Debt Collection Practices Act, 15
U.S.C. §§ 1692-1692 Driver's Privacy Protection Act, 18
U.S.C. §§ 2721–2725 = Uzbekistan =
Though the right to privacy exists in several regulations, the most effective
privacy protections come in the form of constitutional articles of Uzbekistan.
Varying aspects of the right to privacy are protected in different ways by
different situations. See also
Data Protection Act 1998 Data Protection Directive
Data protection and privacy laws Electronic Communications Privacy Act
Personality rights Privacy Act of 1974
Privacy Act 1988 Right to be forgotten
References External links
2014 International Compendium of Data Privacy Laws, provided by BakerHostetler