# The privacy laws that actually govern your data
A county caseworker pulls up a file: a 14-year-old in foster care, receiving Medicaid-funded mental health treatment, currently subject of a juvenile court proceeding, and a local reporter has just filed a records request asking for "all documentation related to the incident at Lincoln Middle School." Four different laws now claim jurisdiction over pieces of that same file. Two of them contradict each other. Nobody in the building agrees on who signs off.
This is not an edge case. It's Tuesday. Public sector data work means constantly figuring out which law wins when they collide, and the "actually" in this lesson's title matters: theory says "follow the strictest rule," reality says the rules were never designed to talk to each other.
FOIA (Freedom of Information Act): federal law giving the public the right to request records from federal agencies. Most states have their own equivalent (often called a "sunshine law" or state public records act). Default posture: disclose, unless a specific exemption applies.
HIPAA (Health Insurance Portability and Accountability Act, 1996): governs "protected health information" (PHI) held by covered entities (health plans, providers, clearinghouses) and their business associates. Default posture: don't disclose without authorization, with defined exceptions.
FERPA (Family Educational Rights and Privacy Act, 1974): governs student education records held by schools receiving federal funding. Gives parents (or students at 18+) control over disclosure. Enforced by the U.S. Department of Education.
CJIS (Criminal Justice Information Services) Security Policy: the FBI's data security and handling framework for criminal justice information (arrest records, case files, biometric data) shared with state and local law enforcement. Not a privacy law in the FOIA/ sense; it's a security and access-control standard, but it functions as a hard gate on disclosure and system architecture.
State privacy acts: a fast-growing patchwork. As of early 2026, roughly 20 U.S. states have comprehensive consumer privacy laws (California's CCPA/CPRA, Virginia's VCDPA, Colorado's CPACPACost Per Acquisition: the total cost to generate one customer or conversion, computed by dividing total spend by the number of acquisitions.Voir la définition complète →, and others), and separately most states have specific statutes protecting juvenile records, welfare case data, or victim information. These often impose stricter rules than any federal law above.
Walk the same file through each lens:
Who wins? In practice: the most restrictive applicable rule wins for disclosure decisions, but different rules govern different slices of the same file simultaneously. FERPA doesn't override HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation.'s rules on the treatment notes; it just means the file has two masters. CJIS doesn't care about FOIA's public interest test at all, it's a security control layer that sits underneath the disclosure question. A records officer often has to redact the file four different ways for four different legal reasons before anything goes out the door.
This is why big FOIA offices increasingly build redaction logic as a rules engine, not a checklist. A simplified version:
if record.contains(education_data): apply FERPA_rule
if record.contains(health_data): apply HIPAA_rule
if record.contains(juvenile_case_data): apply STATE_JUVENILE_rule
if record.origin == "law_enforcement": apply CJIS_access_rule
release_decision = MOST_RESTRICTIVE(all applicable rules)The point isn't the code, it's the logic: most restrictive rule wins, per data element, not per document. Treat the file as a bundle of tagged fields, not one blob.
| Data type | Governing law(s) | Who enforces |
|---|---|---|
| KKThe average number of new users each existing user generates through referrals. Above 1.0, growth compounds on itself and becomes exponential.Voir la définition complète →-12 student records | FERPA + state student privacy laws | U.S. Dept. of Education |
| Health/behavioral records | HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation. (if covered entity) + state health privacy laws | HHS Office for Civil Rights |
| Police/court records | CJIS + state criminal record statutes + FOIA exemptions | FBI CJIS Division, state AGs |
| General government records | FOIA / state sunshine laws | Courts, state records boards |
| Resident data held by agencies | State comprehensive privacy acts (CCPA-style) | State Attorneys General |
Notice something: almost none of these regulators talk to each other. HHS doesn't enforce FERPA. The Department of Education doesn't enforce CJIS. A single agency (a school district running a health clinic, for instance) can be answerable to three regulators at once for one dataset.
State comprehensive privacy laws (modeled loosely on the EU's GDPR, General Data Protection Regulation) were written for commercial data brokers, but many apply to public sector contractors and, in some states, to agencies themselves. Key mechanics to know:
Practical implication: when your agency signs a contract with an analytics vendor, that contract is now your main privacy control point for state-law compliance, not the underlying federal sector law. Auditors check the contract language first.
Vérification des acquis
1. What is the default disclosure posture of FOIA and state sunshine laws, compared to HIPAA?
2. Why does the caseworker's file in the scenario create real conflict rather than a simple 'follow the strictest rule' situation?
3. What best distinguishes CJIS Security Policy from FOIA, HIPAA, and FERPA?
4. Select ALL correct answers about FERPA as described in the lesson.
Sélectionnez toutes les réponses correctes.
5. Select ALL correct answers about why a single case file (like the foster care example) can trigger multiple overlapping privacy laws at once.
Sélectionnez toutes les réponses correctes.
Knowing the laws is step one. Here's what a functioning governance program runs, on a schedule:
1. Data inventory and classification audit (annual minimum)
MapMapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.Voir la définition complète → every dataset to its governing law(s). If a dataset touches two or more (health + education, or law enforcement + juvenile), flag it as "multi-jurisdiction" and require sign-off from both compliance owners before any release.
2. Access log review (quarterly)
CJIS mandates audit trails for who touched criminal justice information and when. Extend that discipline to HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation. and FERPA data even where not strictly required, it's the fastest way to catch an employee browsing a file they had no case reason to open.
3. Vendor/subprocessor compliance check (at contract renewal, minimum annually)
Confirm the vendor's data handling terms match the strictest law that applies to any data they'll touch. A single vendor serving a school district's health clinic needs to satisfy FERPA, HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation., and the state privacy act simultaneously.
4. Redaction/release test audit (sample basis, ongoing)
Pull a sample of recently released FOIA responses and verify the redactions matched the rules engine logic. This is where agencies get sued: releasing a document that was technically "public" under FOIA but contained a FERPA-protected field nobody flagged.
5. Breach response drill (annual)
HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation. requires breach notification (generally within 60 days to affected individuals). FERPA has no equivalent federal breach clock, states increasingly fill that gap themselves. Know which clock is running before an incident, not during one.
🎬 [VIDEO: "FERPA vs HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation.: Which Law Applies?" — youtube.com — a walkthrough of the U.S. Dept. of Education/HHS joint guidance on overlapping student health records, useful for the exact scenario in this lesson]
For the underlying federal guidance itself, the joint FERPA/HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation. guidance document from the Department of Education and HHS is free and specific: studentprivacy.ed.gov.