US Privacy and Operational Records: A Governance Guide for Directors

Procedures, project files, support histories and review notes describe how work is done. They also name the people who do it and the people it is done for. In the United States there is no single federal privacy law that covers every business. Whether a record may be licensed depends on which state's residents are affected, whether a sector law applies, what the organisation has promised in its notices and contracts, and whether the material is a trade secret.

A board does not need to become expert in each statute. It does need to know which questions to ask, who is accountable for the answers, and what evidence should exist before any discussion with a prospective licensee begins.

Start with an inventory of the record categories, not with a licence term sheet. For each category, ask four questions.

• Whose information is in it? Customers, employees, contractors, children, patients or account holders can each bring a different statute into play.
• Where are those people? Comprehensive consumer privacy laws are enacted state by state. The National Conference of State Legislatures maintains a database of consumer privacy legislation. Use the current database rather than a fixed list.
• What did we promise? Notices, customer contracts, vendor contracts and employment agreements can restrict use even where no privacy statute applies.
• Is it secret know-how? Process documentation can be a trade secret. Sharing it can weaken that protection if the safeguards are thin.

A growing number of states regulate how businesses collect, use and disclose personal information and give residents rights such as access, correction, deletion and the ability to opt out of sale or targeted advertising. Thresholds, definitions and exemptions differ. A law that applies to one category of customer may not apply to employees, and a law that applies in one state may not apply in the next.

California is the clearest worked example. The California Attorney General's CCPA page explains the California Consumer Privacy Act, as amended, and the rights it gives California consumers. The California Privacy Protection Agency publishes the statute text, the current monetary thresholds and the regulations. A disclosure of personal information for money or other valuable consideration can be a "sale" in defined circumstances, so a paid licence of records that still identify people is not automatically outside that concept. There are exceptions, including some service-provider arrangements. Whether one applies is a question for counsel, not a label to assume.

• Confirm which states' residents appear in the records, and which statutes meet their own thresholds for your organisation.
• Read the privacy notice those people were given. If it does not describe this kind of disclosure, that is an obstacle for any record that still identifies a person.
• Map how a request to access, delete or opt out would be honoured after the material has left your systems.
• Do not treat "we are not a data broker" as an answer. The question is whether this disclosure is regulated, whatever the organisation calls itself.

Some records are governed by a federal law whether or not a state privacy statute applies. These are limits on the records, not on the whole company.

• Health information. The HIPAA Privacy Rule applies to protected health information held by covered entities and their business associates. A licence of that information is a disclosure and needs a permitted pathway. HIPAA does not apply to every mention of health in an ordinary business file.
• Financial customer information. The Gramm-Leach-Bliley Act restricts how financial institutions share consumers' nonpublic personal information, including through privacy notices and, in many cases, an opt-out.
• Children. The Children's Online Privacy Protection Rule limits the collection and disclosure of personal information from children under 13. Records that include it need separate scrutiny.
• Promises already made. The Federal Trade Commission treats a privacy or security claim that an organisation does not keep as a deceptive practice. A notice that says customer information is not shared, followed by a licence of that information, is a problem even if no state privacy statute applies.

A privacy statute is not the only restriction. Customer and supplier contracts often prohibit disclosure of the other party's information, including in aggregated or de-identified form. Employment and contractor agreements decide who owns procedures, playbooks and work product. Where copyright is relevant, the US Copyright Office explains works made for hire: authorship depends on the relationship and, for some commissioned works, on a written agreement. A board should not assume the organisation owns every document its staff or contractors created.

For each record category, record who created it, whose information it contains, and which contract limits its use. If the organisation holds the material only to deliver a service to a client, it generally cannot decide on its own to license that material for a new purpose.

Federal law protects trade secrets through the Defend Trade Secrets Act. 18 U.S.C. § 1839 defines a trade secret as business, technical or related information that derives independent economic value from not being generally known, and that the owner has taken reasonable measures to keep secret. State trade secret law often sits alongside it. Operational procedures are a common candidate.

Disclosure under a weak confidentiality clause, or to a recipient who may use the material to compete, can undermine the "reasonable measures" that the protection depends on. If the value of the records is that competitors do not have them, say so in the paper to the board and put the confidentiality terms in front of counsel before anything is shared. The commercial shape of those terms is covered in the licensing guide.

Removing names is the usual proposal, and it is often not enough. The Federal Trade Commission has warned that hashing and similar transforms do not make personal information anonymous if the result can still be associated with a person. Do not describe material as anonymous in a notice or a contract unless the method, the testing and the residual risk support that description.

• Define what is removed, transformed or generalised, and who does it, including free-text fields, comments and attachments.
• Test whether a motivated recipient with other information could still identify a person or a client.
• Where the records are protected health information, use one of the two methods in the HHS de-identification guidance: expert determination or safe harbor. Those methods are for HIPAA, not a general label for other records.
• Where a state law such as the CCPA defines "deidentified," meet that definition rather than a looser internal one. The Attorney General's CCPA materials and the CPPA regulations are the place to check the current text.
• Prohibit the recipient from attempting to re-identify anyone, and keep the right to test that the prohibition is honoured.

Where an organisation has no dedicated privacy role, the same functions still need an owner, whether internal or external. Our board paper guide shows how to present these decisions for approval. Organisations weighing UK records should use the UK governance guide as well.

We do not review records, decide which US law applies, or clear data for release. Those judgements are yours and your advisers'. We are an independent introduction service, and we explain how we are paid on our disclosure page.