Skip to content

Laws and data licensing

Laws and AI data licensing

General information, not legal advice. Laws change and their application depends on your facts. SourceX assesses which rules apply deal by deal with your counsel.

Laws

By country

Call recording rules by state

Call recording rules by EU country

What are data privacy laws, and which ones come up most often?#

Data privacy laws are rules on how organizations collect, use, share and protect information about identifiable people. Some are comprehensive and cover most personal data in a jurisdiction, like the EU GDPR; others are sectoral and cover one kind of record or organization, like HIPAA for health information held by covered entities.

Which law applies depends on whose data it is, where those people are, what kind of business holds it and what the records contain, not only on where the company is based. The GDPR, for example, reaches companies outside the EU that offer goods or services to people in the EU or monitor their behavior there.

The table below shows how the most-searched laws differ in scope.

What are data privacy laws, and which ones come up most often?
LawTypeWho it reachesWhat it asks before data is reused or shared
EU GDPRComprehensiveOrganizations established in the EU, and non-EU organizations offering goods or services to, or monitoring, people in the EUA lawful basis from the list in Article 6, and reuse compatible with the purpose the data was collected for
California CCPA (as amended by the CPRA)Comprehensive state lawFor-profit businesses doing business in California that meet a revenue, data-volume or data-sales thresholdNotice, and honoring rights to know, delete, correct, opt out of sale or sharing, and limit use of sensitive data
HIPAA Privacy RuleSectoral (health)Covered entities such as health plans and most providers, and their business associatesAuthorization or a permitted use, unless the data is de-identified by Safe Harbor or Expert Determination
Other U.S. state privacy actsComprehensive state lawsBusinesses above each state's thresholds that hold data about its residentsSimilar consumer rights and opt-outs; check each state's thresholds and sensitive-data rules
Philippines Data Privacy Act of 2012Comprehensive national lawOrganizations processing personal information, enforced by the National Privacy CommissionLawful processing under the Act; unauthorized processing of sensitive personal information carries criminal penalties

What does data privacy compliance mean in practice?#

Data privacy compliance means being able to show, for each set of personal data, which laws apply, what you are allowed to do with it, and that you did only that. It is an ongoing record, not a one-time certificate.

For a business considering reuse of its records, such as licensing them to an AI developer, the practical test is whether each step below can be answered in writing. Counsel reviews the specific facts; this is general information, not legal advice.

  • Map the data: which systems hold personal data, about whom, and in which countries or states those people live.
  • Identify the laws: comprehensive laws by residence of the people, sectoral laws by record type (health, financial, education, biometric, call recordings).
  • Check the basis or notice: under the GDPR, which Article 6 basis covers the new use; under U.S. state laws, what your privacy notice said and whether the use counts as a sale or sharing.
  • Check purpose fit: whether the new use is compatible with why the data was collected, since the GDPR's purpose limitation principle bars incompatible further processing.
  • Minimize: keep only fields needed for the purpose, which is also what the GDPR's data minimisation principle requires.
  • De-identify to the standard of the law that applies, for example HIPAA Safe Harbor or Expert Determination for health records, and document how.
  • Record rights requests and opt-outs, and exclude records from people who opted out or asked for deletion.
  • Keep the evidence: the data map, the decisions and who approved them, so the analysis can be shown later.

Which data privacy act is someone usually asking about?#

There is no single U.S. federal law called the Data Privacy Act. In the United States, the phrase usually means a state's comprehensive privacy law, many of which carry names like Colorado Privacy Act or Connecticut Data Privacy Act, or the California Consumer Privacy Act.

Outside the U.S., the Data Privacy Act most often means the Philippines' Republic Act 10173, the Data Privacy Act of 2012, which created the National Privacy Commission to administer and enforce it. If you are checking obligations, start from where the people in your records live, then use the law and country guides above.

Sources for this section

  • The GDPR applies to non-EU organizations that offer goods or services to people in the EU or monitor their behavior there. Source
  • The Court of Justice describes GDPR Article 6(1) as an exhaustive list of lawful bases and sets out the Article 5 purpose limitation and data minimisation principles. Source
  • The California Attorney General lists who the CCPA applies to and the consumer rights to know, delete, correct, opt out and limit use of sensitive data. Source
  • HHS describes the Safe Harbor and Expert Determination methods for de-identifying health information under the HIPAA Privacy Rule. Source
  • The Philippines National Privacy Commission publishes Republic Act 10173, the Data Privacy Act of 2012. Source
See if your company qualifies