In 1968, the Council of Europe began to study the effects of technology on human rights, recognizing the new threats posed by computer technology that could link and transmit in ways not widely available before. As well, in 1969 the Organisation for Economic Co-operation and Development (OECD) began to examine the implications of personal information leaving the country. All this led council to recommend that policy be developed to protect personal data held by both the private and public sectors, leading to Convention 108. In 1981, Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108) was introduced. One of the first privacy laws ever enacted was the Swedish Data Act in 1973, followed by the West German Data Protection Act in 1977 and the French Law on Informatics, Data Banks and Freedoms in 1978.
In Canada, a Privacy Commissioner of Canada was established under the Canadian Human Rights Act in 1977. In 1982, the appointment of a Privacy Commissioner was part of the new Privacy Act. Canada signed the OECD guidelines in 1984.
Fair information practice
There are significant differences between the EU data protection and US data privacy laws. These standards must be met not only by businesses operating in the EU, but also by any organization that transfers personal information collected concerning citizen of the EU. In 2001 the United States Department of Commerce worked to ensure legal compliance for US organizations under an opt-in Safe Harbor Program. The FTC has approved TRUSTe to certify streamlined compliance with the US-EU Safe Harbor.
In 1995 the European Union (EU) introduced the Data Protection Directive for its member states. As a result, many organizations doing business within the EU began to draft policies to comply with this Directive. In the same year the U.S. Federal Trade Commission (FTC) published the Fair Information Principles which provided a set of non-binding governing principles for the commercial use of personal information. While not mandating policy, these principles provided guidance of the developing concerns of how to draft privacy policies.
The United States does not have a specific federal regulation establishing universal implementation of privacy policies. Congress has, at times, considered comprehensive laws regulating the collection of information online, such as the Consumer Internet Privacy Enhancement Act and the Online Privacy Protection Act of 2001, but none have been enacted. In 2001, the FTC stated an express preference for "more law enforcement, not more laws" and promoted continued focus on industry self-regulation.
In many cases, the FTC enforces the terms of privacy policies as promises made to consumers using the authority granted by Section 5 of the FTC Act which prohibits unfair or deceptive marketing practices. The FTC's powers are statutorily restricted in some cases; for example, airlines are subject to the authority of the Federal Aviation Administration (FAA), and cell phone carriers are subject to the authority of the Federal Communications Commission (FCC).
In some cases, private parties enforce the terms of privacy policies by filing class action lawsuits, which may result in settlements or judgements. However, such lawsuits are often not an option, due to arbitration clauses in the privacy policies or other terms of service agreements.
While no generally applicable law exists, some federal laws govern privacy policies in specific circumstances, such as:
The Gramm-Leach-Bliley Act requires institutions "significantly engaged" in financial activities give "clear, conspicuous, and accurate statements" of their information-sharing practices. The Act also restricts use and sharing of financial information.
The Health Insurance Portability and Accountability Act (HIPAA) privacy rules requires notice in writing of the privacy practices of health care services, and this requirement also applies if the health service is electronic.
Canada's federal Privacy Law applicable to the private sector is formally referred to as Personal Information Protection and Electronic Documents Act (PIPEDA). The purpose of the act is to establish rules to govern the collection, use and disclosure of personal information by commercial organizations. The organization is allowed to collect, disclose and use the amount of information for the purposes that a reasonable person would consider appropriate in the circumstance.
The Act establishes the Privacy Commissioner of Canada as the Ombudsman for addressing any complaints that are filed against organizations. The Commissioner works to resolve problems through voluntary compliance, rather than heavy-handed enforcement. The Commissioner investigates complaints, conducts audits, promotes awareness of and undertakes research about privacy matters.
There are significant differences between the EU data protection and US data privacy laws. These standards must be met not only by businesses operating in the EU, but also by any organization that transfers personal information collected concerning citizen of the EU. In 2001 the United States Department of Commerce worked to ensure legal compliance for US organizations under an opt-in Safe Harbor Program. The FTC has approved a number of US providers to certify compliance with the US-EU Safe Harbor.
Online privacy certification programs
Online certification or "seal" programs are an example of industry self-regulation of privacy policies. Seal programs usually require implementation fair information practices as determined by the certification program and may require continued compliance monitoring. TRUSTe, the first online privacy seal program, included more than 1,800 members by 2007 Other online seal programs include the Trust Guard Privacy Verified program, eTrust, and Webtrust.
Some websites also define their privacy policies using P3P or Internet Content Rating Association (ICRA), allowing browsers to automatically assess the level of privacy offered by the site, and allowing access only when the site's privacy practices are in line with the user's privacy settings. However, these technical solutions do not guarantee websites actually follows the claimed privacy policies. They also require users to have a minimum level of technical knowledge to configure their own browser privacy settings. These automated privacy policies have not been popular either with websites or their users.
Many critics have attacked the efficacy and legitimacy of privacy policies found on the Internet. Concerns exist about the effectiveness of industry-regulated privacy policies. For example, a 2000 FTC report Privacy Online: Fair Information Practices in the Electronic Marketplace found that while the vast majority of website surveyed had some manner of privacy disclosure, most did not meet the standard set in the FTC Principles. In addition, many organizations reserve the express right to unilaterally change the terms of their policies. In June 2009 the EFF website TOSback began tracking such changes on 56 popular internet services, including monitoring the privacy policies of Amazon, Google and Facebook.
- McCormick, Michelle. "New Privacy Legislation." Beyond Numbers 427 (2003): 10-. ProQuest. Web. 27 Oct. 2011
- Cavoukian, Ann (1995). Who Knows: Safeguarding Your Privacy in A Networked World (paperbackRandom House of Canada: Random House of canada. ISBN 0-394-22472-8.).
- Overview of the Data Protection Directive, EC.europa.eu
- U.S. Federal Trade Commission Fair Information Practice Principles, FTC.gov
- HR 237 IH, The Consumer Internet Privacy Enhancement Act, as Introduced in House, 107th Congress Loc.gov.
- HR 89 IH, Online Privacy Protection Act of 2001, as Introduced in House, 107th Congress Loc.gov
- Kirby, Carrie "FTC drops the Call for New Internet Privacy Laws," SFGate, October 5, 2001. SFgate.com
- Implementation of 15 U.S.C. §§ 41-58, FTC.gov
- Electronic Privacy Information Center, Air Travel Privacy, Epic.org. Also see FAA Enforcement Database at FAA.gov.
- Helmer, Gabriel M. "Cracking Down: FCC Initiates Enforcement Action Against Hundreds of Telecommunications Carriers For Failing to Certify Compliance With Customer Privacy Rules Security, Privacy and the Law, Foley Hoag, LLP, May 2009. Securityprivacyandthelaw.com. Also see FCC Enforcement Center at FCC.gov
- The Children's Online Privacy Protection Act, FTC.gov
- COPPA Safe Harbors discussed, Cybertelecom Federal Internet Law & Policy - an Educational Project. Krohn & Moss Consumer Law Center, Cybertelecom.org
- Discussion of compliance with the Children's Online Privacy Protection Act, FTC Privacy Initiatives, FTC.gov
- Data Privacy, A Safe Harbor Approach To Privacy: TRUSTe Recommendations, Center for Democracy and Technology, CDT.org
- Gramm-Leach-Bliley Act, Loc.gov
- "The Financial Privacy Requirements of the Gramm-Leach-Bliley Act", FTC Facts for Business", FTC.gov
- Information Regarding the Gramm-Leach-Bliley Act of 1999, US. Senate Committee on Banking, Housing, and Urban Affairs. Senate.gov
- Understanding HIPAA Privacy, HHS.gov Health Information Privacy, HHS.gov
- Notice of HIPAA Privacy Practices. Privacy/ Data Protection Project, Miller School of Medicine Miami University, Miami.edu
- Privacy Laws, California Office of Information Security and Privacy Protection CA.gov
- Deceptive Trade Practices, Enotes.com
- Safe Harbor Compliance, Export.gov
- "Privacy Act 1988". AustLII. Retrieved 2013-06-25.
- "National Privacy Principles". Office of the Australian Information Commissioner. Retrieved 2013-06-25.
- TRUSTe, Truste.com
- CDT Guide to Online Privacy, Center for Democracy and Technology, 2009. CDT.org
- Trust Guard Privacy Verified Seal program. Trust-Guard.com
- Etrust, Etrust.org
- Webtrust Seal Program, Webtrust.org
- Softsteel Solutions "The Platform for Privacy Preferences Project (P3P)", Softsteel.co.uk
- Millis, Elinor, "EFF tracking policy changes at Google, Facebook and others," Cnet Digital News, June 2009. Cnet.com
- Fogg, B. J. "How Do People Evaluate a Web Site's Credibility? (abstract)" BJ, Stanford Persuasive Technology Lab, November 2002, Consumerwebwatch.org. Stanford Web Credibility Project found at Stanford.edu.
- Acquisti, Alessandro and Janice Tsai, Serge Egelman, Lorrie Cranor, "The Effect of Online Privacy Information on Purchasing Behavior: An Experimental Study" Carnegie Mellon University, 2007. Econinfosec.org
- Gorell, Robert. "Do Consumers Care About Online Privacy?" October, 2007. Grokdotcom.com citing to a study by Chris Hoofnagle, UC-Berkeley's Bolt School of Law. Samuelson Law, Technology & Public Policy Clinic, Berkeley.edu
- Goldman, Eric. "On My Mind: The Privacy Hoax," October, 2002, EricGoldman.org
- Gazaleh, Mark. "Online trust and perceived utility for consumers of web privacy statements", WBS  August, 2008.
- Gazaleh, Mark (2008). Online trust and perceived utility for consumers of web privacy statements WBS: London 
- Cavoukian, Ann (1995). Who Knows: Safeguarding Your Privacy in A Networked World (paperbackRandom House of Canada: Random House. ISBN 0-394-22472-8.).