The European approach to privacy is based on the recognition of privacy as a fundamental human
right that requires strong legal protection and oversight. The EU has adopted comprehensive and
binding privacy laws, such as the General Data Protection Regulation (GDPR) and the ePrivacy
Directive, that apply to all sectors and activities involving personal data. The EU also has independent
data protection authorities (DPAs) that monitor and enforce compliance with the privacy laws, and a
European Data Protection Board (EDPB) that issues guidance and opinions on privacy matters. The
EU also requires adequate levels of privacy protection for personal data transferred to third countries
or international organizations.
In contrast, the U.S. approach to privacy is based on a sectoral and self-regulatory model that relies
on a combination of federal and state laws, industry codes of conduct, consumer education, and
market forces. The U.S. does not have a single, comprehensive, and enforceable federal privacy law
that covers all sectors and activities involving personal data. Instead, the U.S. has a patchwork of
federal and state laws that address specific issues or sectors, such as health, financial, children’s, and
electronic communications privacy. The U.S. also has various federal and state agencies that share
jurisdiction over privacy matters, such as the Federal Trade Commission (FTC), the Federal
Communications Commission (FCC), and the Department of Health and Human Services (HHS). The
U.S. also relies on self-regulation by industries that develop and adhere to voluntary codes of
conduct, standards, and best practices for privacy. The U.S. also allows personal data to be
transferred to third countries or international organizations without requiring adequate levels of
privacy protection, as long as the data subjects have given their consent or the transfer is covered by
a mechanism such as the Privacy Shield or the Standard Contractual Clauses.
Some supporters of the European approach to privacy are skeptical about self-regulation of privacy
practices because they believe that self-regulation is not effective, consistent, or accountable enough
to protect the rights and interests of data subjects. They argue that self-regulation may not provide
sufficient incentives or sanctions for industries to comply with privacy rules, or to adopt privacy-
enhancing technologies and practices. They also contend that self-regulation may not reflect the
views and expectations of data subjects, or address the emerging and complex privacy challenges
posed by new technologies and business models. They also question the transparency and legitimacy
of self-regulation, and the ability of data subjects to exercise their rights and seek redress for privacy
violations. Reference:
IAPP CIPP/US Study Guide, Chapter 1: Introduction to the U.S. Privacy Environment, pp. 9-10, 16-17
IAPP website, CIPP/US Certification
NICCS website, Certified Information Privacy Professional/United States (CIPP/US) Training
