Data protection has become a global issue, but approaches vary significantly across regions. The European Union has established the highest standard with GDPR, while in America we find a mosaic of legislations with different approaches, ranging from sectoral models to fragmented state laws.
The General Data Protection Regulation (GDPR) came into force in May 2018 and has become the global standard for data protection. Its approach is individual-centered, giving citizens unprecedented control over their personal data. The GDPR is not just a European law; its scope is extraterritorial, meaning that any organization processing EU citizens' data, regardless of where it is located, must comply with its provisions.
The key principles of the GDPR establish the foundations of its approach. Lawfulness, fairness and transparency require that data be processed legally, fairly and transparently for citizens. Purpose limitation establishes that data can only be collected for specific and explicit purposes, and cannot subsequently be used for incompatible purposes. Data minimization limits collection to data strictly necessary for the intended purpose. Accuracy requires data to be accurate and kept up to date, with mechanisms for citizens to correct incorrect information. Storage limitation prevents data from being kept longer than necessary, establishing clear timelines for deletion. Integrity and confidentiality requires technical and organizational measures to protect data against unauthorized access, loss or destruction.
The citizens' rights under GDPR are extensive and powerful. The right of access (Art. 15) allows citizens to request and obtain a copy of their personal data, as well as information on how it is being processed. The right to rectification (Art. 16) ensures that citizens can correct inaccurate or incomplete data. The right to erasure (Art. 17), also known as the right to be forgotten, allows requesting the deletion of data when it is no longer necessary, when consent is withdrawn or when they object to processing. The right to restriction of processing (Art. 18) allows restricting data processing in certain circumstances. The right to data portability (Art. 20) facilitates the transfer of data between service providers. The right to object (Art. 21) allows objecting to data processing for direct marketing purposes or when based on legitimate interests. The right not to be subject to automated decision-making (Art. 22) protects citizens against decisions based solely on automated processing that produce legal effects or significantly affect them.
Penalties for GDPR non-compliance are significant and deterrent. Supervisory authorities can impose fines of up to €20 million or 4% of the organization's annual global turnover, whichever is higher. This enforcement power has made the GDPR a law with real compliance power, driving organizations to invest seriously in data protection and privacy.
In America, the data protection landscape is notably different from the European one. The approach is more fragmented and sectoral, with a combination of federal, state and sectoral laws creating a complex ecosystem for organizations.
In the United States, there is no single federal data protection law equivalent to the GDPR. Instead, we find a sectoral approach with laws specific to particular industries. HIPAA (Health Insurance Portability and Accountability Act) regulates the protection of health data, establishing privacy and security standards for medical information. GLBA (Gramm-Leach-Bliley Act) protects consumers' financial data, requiring financial institutions to explain their information-sharing practices and protect sensitive data. COPPA (Children's Online Privacy Protection Act) protects the privacy of minors under 13, requiring parental consent for data collection from children. FCRA (Fair Credit Reporting Act) regulates the collection and use of consumer credit information.
In the absence of a general federal law, US states have begun to legislate on data protection, creating a mosaic of state laws. The CCPA (California Consumer Privacy Act) and its successor, the CPRA (California Privacy Rights Act), are the most comprehensive laws in the US and the ones most similar to the GDPR. The CCPA grants California residents rights such as the right to know what data is collected about them, the right to delete their data, the right to opt out of the sale of their data, and the right not to be discriminated against for exercising their privacy rights. The CPRA expanded these rights and created the California Privacy Protection Agency to oversee compliance.
Other states have followed California's lead, such as Virginia with the VCDPA and Colorado with the CPA, each with its own particularities, rights and requirements. This legislative fragmentation creates a significant challenge for organizations operating across multiple states, who must navigate a diverse and sometimes contradictory set of requirements.
The main differences between the European and American approaches are profound and reflect different philosophies. The EU starts from a rights-based approach, treating data protection as an inherent human right. The US, in contrast, adopts a market and consumer-based approach, protecting citizens as consumers rather than as holders of fundamental rights. The EU requires a legal basis for any data processing, while in the US processing is permitted by default unless a specific law restricts it. The EU imposes the data minimization principle, limiting collection to what is strictly necessary, while the US tends to allow greater data collection. The EU establishes proportionate and deterrent sanctions at the level of business turnover, while in the US sanctions vary by law and are usually less severe, although class actions can generate significant costs.
In Latin America, the landscape is equally diverse. Countries like Brazil have adopted laws inspired by the GDPR, such as the LGPD (Lei Geral de Proteção de Dados), which came into force in 2020 and follows the European model of rights and obligations. Argentina was a pioneer in the region with its Personal Data Protection Law of 2000, recognized by the EU as a country with an adequate level of protection. Colombia, Chile, Peru and Mexico have approved their own data protection laws, although with different levels of implementation and compliance.
The future of data protection points towards greater global harmonization, although the path is long. The GDPR has established a standard that many countries are adopting as a model, creating a convergence towards higher protection standards. However, cultural and political differences between regions will continue to shape distinct approaches. Data protection is a constantly evolving field, with new technologies such as generative artificial intelligence and the internet of things posing new challenges that will require innovative regulatory responses.
Data protection in the EU and America represents two different approaches to the same challenge: how to protect citizens in the digital age. While the EU opts for a uniform approach based on fundamental rights, America opts for a more fragmented and sectoral model that reflects its political and cultural diversity. Both approaches have strengths and weaknesses, and convergence towards common standards will likely continue in the coming years.
At Curaduriadedatos.com, we help companies navigate the complex data protection landscape in both regions, ensuring regulatory compliance and citizen trust.