Chapter 9: North America: Regulatory Diversity and Challenges

Introduction

North America is one of the most complex and fragmented data protection landscapes in the world. In contrast to other parts of the world that have established more unified and comprehensive privacy regimes, like the European Union's General Data Protection Regulation (GDPR), North America, especially the United States, has adopted a more fragmented approach, with federal, state, and industry-specific laws and regulations governing privacy. (Greenleaf, 2023) This disjointed arrangement has developed over decades as technology has advanced, economic interests have shifted, and political viewpoints have varied on the dilemmas involved in safeguarding privacy while fostering business opportunities for innovation.

The regulatory differences among North American countries are a reflection of the legal philosophy and traditions of governance that prevail in each of these countries. The history of U.S. privacy regulation has been sectoral, meaning the various sectors like healthcare, finance, communications, and education have different privacy laws. This focuses on innovation, consumer protection, and self-regulation based on the market, without having one federal privacy law (Solove & Schwartz, 2024). This makes it difficult for companies that cross industries to deal with a range of overlapping compliance requirements that differ vastly with the kind of data they gather, the business they serve, and the jurisdictions where they do business.

Canada has taken a more holistic and rights-based stance on privacy protection, however. Canadian privacy laws view privacy as an essential part of people's democracy and autonomy. Federal laws, the Personal Information Protection and Electronic Documents Act (PIPEDA), set out general guidelines for handling personal information in the private sector, and provincial privacy laws build on and in some cases, are more stringent than federal laws (Office of the Privacy Commissioner of Canada, 2024). This framework is more consistent with international privacy requirements and has allowed for transfers of data across borders to jurisdictions that have acceptable privacy protections.

The speed in digital technologies, cloud computing, AI, big data analytics, and cross-border data flows have brought privacy to the forefront of effective governance across North America. The massive collection, processing and dissemination of personal data by organizations are opening up new opportunities for innovation, but also posing unprecedented risks to individuals of data breaches, identity theft, unauthorized surveillance, and algorithmic discrimination (Westin, 2023). The pressure to improve privacy protection and accountability mechanisms is growing as the awareness around data misuse rises and as high-profile cybersecurity incidents have come to light, prompting governments and regulators alike to step up their efforts to protect the privacy of personal data.

The privacy environment in North America has made tremendous strides over the last few years. A handful of U.S. states have adopted comprehensive privacy legislation that empowers consumers to gain more control over their personal information and puts new requirements on entities that have access to consumer data, such as businesses, government agencies and service providers (International Association of Privacy Professionals [IAPP], 2024). California's privacy regime, in particular, is highly significant, enshrining rights to access, deletion and correction of data, and opt-outs for data sharing and targeted advertising. The progress is towards more widespread privacy regulation in the United States, with significant differences in state laws.

Meanwhile, Canada is updating its privacy system to address new technological and economic developments. Legislative changes are being proposed to enhance privacy rights for individuals, hold organizations more accountable and provide for better enforcement capabilities for privacy regulators. The reforms are a growing recognition that good data governance is vital to securing trust in digital ecosystems and sustainable economic growth in the information age (Bennett & Raab, 2020).

The patchwork of privacy laws and policies in North America presents both opportunities and challenges for businesses, policymakers, and consumers. Regulatory diversity enables the adaptation of legal formalities to economic and social realities, but also means that conformity to a variety of regulations is complex, legal uncertainty and higher costs are present for organisations involved in cross-border and cross-national transactions. Multinational companies frequently need to design complex programs for privacy management that meet several regulatory requirements at once.

The chapter considers data privacy in North America, including in the United States with its federal and state privacy regimes, industry-specific statutes, Canada's wide-ranging privacy regime, and new bills. It also delves into the issues of regulatory fragmentation, cross-border data transfers, technological innovation and organizational compliance, thereby offering a thorough understanding of the changing governance landscape and how it affects data protection practices across the region.

9.1 United States Data Privacy Landscape

There is no single federal data protection law in the United States that is similar to the European Union's General Data Protection Regulation (GDPR). Rather, privacy regulation is achieved through a series of constitutional safeguards, federal laws and regulations, state regulations, regulatory agency enforcement, and industry-specific regulations. This is a decentralized system that has been built up over time, and the United States would prefer to have different regulations for each sector and different forms of governance for each sector instead of having a single national privacy regime (Solove & Schwartz, 2024).

The U.S. privacy model is typically referred to as “sectoral” and “self-regulatory” because the different types of personal information are governed by different regimes of regulations based on how the information is collected and used. Federal laws are not intended to impose sweeping privacy rights that would apply to every industry, but instead focus on certain industries that are believed to be sensitive or vulnerable. This means that organisations have to meet several regulatory obligations as it relates to their operations and the type of data they handle (Cate & Mayer-Schönberger, 2019).

There are several Federal laws that provide the basis for privacy protection in the United States. The Health Insurance Portability and Accountability Act (HIPAA) govern the collection, storage, and disclosure of personal health information by healthcare providers, insurers, and related entities. The Gramm-Leach-Bliley Act (GLBA) governs the processing of financial data by banks, insurance companies and financial institutions, mandating the implementation of safeguards to protect data of customers. The Children's Online Privacy Protection Act (COPPA) provides specific protections for children under 13 years of age by setting standards for the collection of personal information via the Internet and on Web sites. In addition, the Fair Credit Reporting Act (FCRA) regulates the collection, use, and dissemination of consumer credit information, ensuring that credit reporting is accurate and fair (Solove & Schwartz, 2024).

In addition to these laws, there are also many other federal regulations that help to form the privacy framework. Electronic Communications Privacy Act (ECPA) applies to access to electronic communications, and Family Educational Rights and Privacy Act (FERPA) applies to student educational records. The Federal Trade Commission (FTC) also has a key role in privacy enforcement, as it has the power to respond to personal data collection practices that are unfair or deceptive. Although there is no federal privacy authority, the FTC is one of the most significant privacy regulators in the United States, having driven change through enforcement actions, settlements, and policy guidance (Richards & Hartzog, 2022).

A distinguishing characteristic of the U.S. privacy landscape is the increasing role of state governments in privacy regulation. Given the increasing data privacy consumer concerns and potential misuse of data, many States have passed legislation that addresses privacy broadly. The California Consumer Privacy Act (CCPA) and the later California Privacy Rights Act (CPRA) are the most notable examples and provide for consumers' rights to access, correct, delete and opt out of the sale or disclosure of personal information. Since then, comparable laws have been enacted in states like Virginia, Colorado, Connecticut, Texas and Utah, which has led to a more complicated regulatory landscape for businesses nationwide (IAPP, 2025).

The multi-layered structure of the U.S. privacy landscape is the result of policy preferences that have long focused on the importance of promoting privacy protection while also accounting for economic growth, technology, and minimal government involvement. Policymakers have consistently stated that too tight a regulation may stifle innovation, competitiveness and may create undue compliance costs for the business community. Thus, privacy governance has emerged through a mix of legislation, industry best practices, self-regulation, and enforcement rather than through a single federal framework (Westin, 2023).

But this is creating challenges due to the lack of a single national privacy law. There are various legal requirements put to companies in different industries and states, making it challenging for companies, especially those with international or tech operations. Companies often don't know what laws to follow, what to report, what consumers have the right to do, or what the law's enforcement guidelines are. In addition, different levels of privacy protection may lead to different experiences for consumers and different types of protections depending on the location where they are and the type of sector that has their personal information (Solove & Schwartz, 2024).

When it comes to privacy regulation, there has been a growing debate as digital platforms and tech companies rapidly take over more and more control. Giant companies like Google, Meta Platforms, Apple, and Amazon gather vast amounts of personal data online via advertising platforms, AI systems, cloud storage, and other services. They have been criticized for their comprehensive data collection, tracking of behavior, targeted advertising, algorithmic decision-making, and international data transfers without user consent. As a result, these groups have become key participants in the development of privacy standards in their own governance structures, industry efforts and reactions to regulatory changes (Zuboff, 2019).

New technologies like Artificial Intelligence, machine learning, biometric identification systems and the Internet of Things (IoT) continue to pose new challenges to current privacy regimes. These technologies allow for unprecedented data collection, analysis and automation, some of which are even greater than what was originally expected of under previous laws. Policymakers, regulators, and industry stakeholders are increasingly aware of the need for the modernization of privacy laws that can keep up with the changing nature of technological risks and the United States' desire to remain competitive and innovative (Richards & Hartzog, 2022).

In sum, the U.S. data privacy landscape continues to be the most dynamic and complex on the planet. The sectoral approach is flexible, promotes innovation, but also leads to fragmentation, regulatory uncertainty and different degrees of privacy protection. Given the growing trend of state privacy laws and the ongoing effort to draft a comprehensive federal privacy law, the U.S. privacy landscape will likely keep changing as technology advances, consumers evolve, and laws are passed and enforced globally.

9.2 Sector-Specific Regulation

In the United States, there is currently no single law to protect privacy, but rather, privacy rights are covered by sector-specific laws. This translates into a variety of privacy rules in different industries and data types.

Key sectors include:

Healthcare

HIPAA Protected – protects medical records and health information.

Financial Services

It is governed by GLBA, the regulations governing financial institutions' collecting and sharing of consumer information.

Education

Student records are covered by the Family Educational Rights and Privacy Act (FERPA).

Children’s Online Data

COPPA applies to data collected from children under 13.

While the sectoral laws offer robust protection in certain domains, they also contain loopholes in other areas, especially the new digital sectors like social networks, artificial intelligence and e-commerce.

This silo mentality poses problems for companies that span different areas of business and digital channels.

9.3 State-Level Privacy Laws

In recent years, a number of U.S. states have begun to assert more control over privacy by passing detailed data protection legislation in response to increased concerns about the collection, processing and commercialization of personal data. This shift is driven in part by the lack of a comprehensive federal privacy law and the resulting need of state legislatures to craft their own privacy laws that will strengthen consumer privacy rights and impose accountability measures on organizations that collect and process personal information (Solove & Schwartz, 2024).

With the increasing significance of data-driven business models, digital advertising, artificial intelligence, the cloud, and social media platforms, consumer concern has risen over the use of data, unauthorized access to personal data, identity theft, and cyber security breaches. To counter that, some states have enacted laws that would give consumers more information and control over that personal information and set more standards for compliance by businesses (Greenleaf, 2023).

California has become the most significant state in the U.S. to impact privacy law, amongst these efforts. California law has served as a national model because it has a large population, a high economic footprint and a high clustering of large technology firms. The California Consumer Privacy Act (CCPA), enacted in 2018, is a significant milestone in the evolution of U.S. privacy law, providing consumers with robust rights regarding their personal data. The CPRA, which took effect in full in 2023, furthered these rights with new rights for consumers, the establishment of the California Privacy Protection Agency (CPPA), and more robust enforcement tools (California Privacy Protection Agency, 2024).

Other states have enacted sweeping privacy laws, emulating California. In a series of state privacy laws, Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), Utah Consumer Privacy Act (UCPA), Texas Data Privacy and Security Act (TDPSA), and other state legislation have established privacy provisions that aim to achieve a balance between consumer protection and business innovation. While some of the laws have similar principles, there are significant distinctions in terms of scope, enforcement, consumer rights, and compliance requirements (International Association of Privacy Professionals [IAPP], 2025).

Typically, these state privacy laws give consumers a number of basic rights concerning their information. These rights include:

The right to be informed on the categories of personal data collected, processed and communicated by the organizations.

The right to information regarding personal information that businesses have on them.

The right to rectify incorrect personal data.

The right to have their personal data removed from the system when there is no longer a need for it.

Right to object to giving up or sharing personal data.

The right to opt-out of targeted advertising and profiling.

Right to data portability, which allows consumers to receive copies of their personal data in a "portable and reusable format.

The right to non-discrimination, which will not be used to take any measures against someone for exercising their right to privacy (Richards & Hartzog, 2022).

One thing that stands out about many state privacy laws is the greater focus on organizations' accountability. Companies may need to carry out data protection reviews, put in place reasonable data security, have clear privacy notices, and put in place procedures for consumers to raise queries. Some legislation also mandates that organizations assess risks that emerge from automated decision making, profiling and processing of sensitive personal data including biometric, health and geolocation data (Bamberger & Mulligan, 2015).

State privacy laws have made privacy more robust for consumers, but also introduced a complex and fragmented regulatory landscape. The present system is often referred to as a "patchwork" system owing to the variations in the privacy requirements in different jurisdictions. Definitions of sensitive data, the extent to which it applies, enforcement authority and consumer rights, for instance, can differ among states. As a result, organizations with operations in several states must keep a close eye on the legislative activity and design compliant programs to meet the compliance requirements of several standards at once (Greenleaf, 2023).

This division creates significant difficulties for businesses with regard to operations and finances. For businesses involved in interstate trade, the legal review, employee training, conducting privacy impact assessments, investing in cyber security improvements, and establishing consumer rights management systems can all lead to higher compliance expenses. These requirements might be more onerous for small and medium sized enterprises (SMEs) with restricted financial and technical capacities. In addition, multinational businesses frequently have to cope with different state laws and international privacy laws, including the GDPR, Personal Information Protection and Electronic Documents Act (PIPEDA) (Bennett & Raab, 2020).

Another difficulty coming from the state level of privacy regulation is uncertainty about it. With more states already passing new privacy laws, organizations are constantly having to change their compliance approach to meet the changing legal requirements. This is a changing landscape that has further brought the need for a broad federal privacy law to establish a consistent national standard and to ease compliance burden for businesses and industry associations (Solove & Schwartz, 2024).

Yet, the state privacy laws have been instrumental in progress in privacy governance in the United States' context. They have brought greater awareness of privacy rights to the public, raised the level of protection of organizations, and sparked more discussion about the future of privacy laws and policy in the digital economy. Many experts see these state initiatives as significant steps toward the possibility of future federal privacy laws that could create a uniform national data protection framework that ensures that consumers will still have strong protections (Richards & Hartzog, 2022).

In conclusion, state privacy laws are a major step forward in the United States' regulatory framework. They offer greater safeguards for individuals and increased corporate accountability, but also lead to regulatory fragmentation and compliance complexity. State governments will continue to be important players in the American data protection policy landscape as digital technologies grow and public demands for privacy deepen.

9.4 Canadian Privacy Framework

Canada has taken a more integrated, principles-based, rights-based stance towards data protection than the United States. The U.S. relies heavily on sector-specific legislation and state-level regulations, whereas Canada has put together a relatively uniform national approach that focuses on individual privacy rights, organizational accountability, and responsible information management. This approach aligns with Canada's acknowledgment of privacy as a fundamental human right that is essential for the protection of individual autonomy, dignity and democratic engagement in increasingly digital societies (Bennett & Raab, 2020).

The central piece of the private sector privacy regime in Canada is the Personal Information Protection and Electronic Documents Act (PIPEDA) which has been in effect since 2001 and was phased in in 2004. PIPEDA regulates the collection, use, disclosure and retention of personal information, by private-sector organizations, for the purposes of commercial activities. The law is national in scope, with the exceptions of the provinces that have significantly similar privacy laws like Quebec, Alberta and British Columbia. In these provinces, PIPEDA still applies to interprovincial and international transfers of personal information, which means that there is a level of consistency in privacy protection across the country (Office of the Privacy Commissioner of Canada, 2024).

PIPEDA is based on these ten principles of Fair Information Practices adopted from the Canadian Standards Association (CSA) Model Code for the Protection of Personal Information. The principles create a complete set of guidelines for responsible handling of data and accountability for organizations. The following are the fundamental concepts:

Accountability – The organizations may be accountable for personal information under their control, and they must appoint people to be accountable for complying.

Identifying Purposes – The purposes of collection of personal information should be identified before or at the time of collection.

Consent – Collection, use and disclosure of personal information generally require meaningful consent.

Collection is limited – Organizations should only collect information that is required for specific purposes.

Restriction of Use, Disclosure, and Retention – Information is not used or disclosed for a purpose other than the one for which it was collected, unless with consent or as required by law.

Accuracy – Personal information should be accurate, complete and up to date as required.

Safeguards – Personal information should be secured from unauthorized access, loss, or misuse.

Openness – Organizations have to ensure that privacy policies and practices are easily accessible.

Individual Access – Individuals can access and correct their personal information.

Challenging Compliance – They can challenge an organization's compliance with privacy obligations (Office of the Privacy Commissioner of Canada, 2024).

One of the key strengths of the Canadian privacy regime is its focus on accountability and organizational responsibility. PIPEDA is somewhat different from other systems in that it is based on a need to ensure that privacy is woven into the way organizations do business. A privacy management program is expected to be established by businesses, as are appropriate security measures, employee training and periodic reviews of compliance procedures. This accountability-based model encourages an organization to proactively identify and manage privacy risks as opposed to simply meeting regulatory requirements when issues arise (Bamberger & Mulligan, 2015).

The Office of the Privacy Commissioner of Canada (OPC) is also an independent federal body that oversees compliance, investigates complaints, conducts audits and raises public awareness about privacy issues, adding to the strength of Canada's privacy governance system. The OPC is the key to interpretation of privacy laws, and provides guidance to organizations, as well as advice to policymakers on new privacy issues. The Commissioner carries out investigations and provides recommendations to ensure that the organizations have high standards of privacy protection as well as balance the legitimate business and governmental interests (Office of the Privacy Commissioner of Canada, 2024).

Canada has historically used a cooperative approach to regulation which seeks to mediate, guide and encourage voluntary compliance with regulation compared to many jurisdictions. This has developed a culture of cooperation between regulators and organizations, but some say that even though the regulations have proven useful, the enforcement action was hampered by relative lack of enforcement authority on the part of the Privacy Commissioner, who could only apply relatively low monetary fines. As a result, questions have arisen about whether current enforcement tools are adequate to meet today's privacy issues related to international tech giants, massive data leaks, and AI-driven tools (Greenleaf, 2023).

It is generally accepted that Canada's privacy regime is very much aligned with international norms, most notably those reflected in the EU's General Data Protection Regulation (GDPR). Transparency, accountability, consent, data minimization and individual rights are highlighted by both. This alignment has helped to enable international transfers of data between organizations in Canada and in Europe, including in relation to adequacy assessments, and interoperability between regulatory systems. The overall level of privacy protection in Canada is less strict than GDPR, however, with regards to administrative penalties, enforcement powers, and some procedural requirements (Kuner, Bygrave, & Docksey, 2020), GDPR is more stringent.

A new generation of digital technologies has emerged that present privacy challenges that were not foreseen in existing law. The collection and processing of personal information has been revolutionised by artificial intelligence, machine learning, biometric technologies, cloud computing, big data analytics and cross-border data transfers. Increasingly there are concerns about transparency, profiling, algorithmic bias and individual autonomy with automated systems that are used by organizations to analyze enormous quantities of personal data. As a result of these technological advancements, there have been demands for greater privacy protections and increased enforcement action (Richards & Hartzog, 2022).

To address these issues, Canada has embarked on major modernization efforts to increase the strength of its privacy regime. The current legislation attempts to replace parts of PIPEDA with more comprehensive legislation that would give individuals greater rights, greater consent requirements, more transparency and more powers to the regulators. The proposed changes also aim to put in place significant monetary fines for serious breaches, create new guidelines for artificial intelligence systems and enhance safeguards for sensitive personal data. These efforts illustrate Canada's efforts to ensure public trust in digital technologies and that privacy regulation continues to be effective in a rapidly changing technological landscape (Government of Canada, 2024).

A key element of Canada's modernization agenda will be balancing innovation with privacy protection. The powers that be realize that data-driven technologies play a major role in economic development, scientific research and public service provision. They also agree, however, that there must be high trust in the public of the way in which personal information is handled in order to foster sustainable digital innovation. This has led to today's privacy reforms being increasingly designed to balance between responsible innovation and core privacy interests and democratic values (Bennett & Raab, 2020).

Overall, however, the privacy landscape in Canada is one of the most sophisticated and internationally recognized data protection landscapes in the world, apart from Europe. Canada has a well-developed governance structure that focuses on accountability, transparency, and individual rights, thanks to PIPEDA, provincial privacy laws, and independent regulatory oversight. While some issues still exist with respect to enforcement, technological shifts and regulatory modernization, the current reforms show that Canada is dedicated to improving privacy protections, and adjusting the law to meet 21st century demands.

9.5 Emerging Regulatory Trends

The data privacy landscape in North America is in the midst of significant change, reflecting the impact of evolving technological developments and concerns about the collection, processing and use of personal information by governments, regulators, companies and consumers. The volume and complexity of data processing activities have grown and grown in recent years thanks to new technology like artificial intelligence (AI), machine learning, cloud computing, biometric systems and the Internet of Things (IoT). Meanwhile, privacy risks have become more common, major data breaches have come to light, and global privacy laws have been enforced, all of which have led to greater demand for privacy safeguards and accountability on the part of organizations (Greenleaf, 2023).

Consequently, privacy laws and regulations in North America are shifting from a compliance-driven approach to a more holistic, consumer-centric, transparent, proactive approach to risk management and responsible innovation. A few trends are likely to define data protection governance in the region in the coming years.

The push for U.S. federal privacy law. Advance toward federal privacy laws in the U.S.

The rise of a strong push for unified federal privacy law in the United States is one of the most notable trends in North American privacy governance. There has been a proliferation of state privacy laws, making businesses increasingly aware that there are a number of different laws and requirements to comply with, each of which differs from state to state. This complicated regulatory landscape has raised compliance expenses and legal uncertainties, leading to calls for a single, federal regulation (Solove & Schwartz, 2024).

There are several bills introduced in congress that would create a nationwide privacy law for everyone: how data is collected, consumers' rights, responsibilities of organizations, and enforcement. There is a general understanding that a single federal privacy law would enhance consistency in the laws and regulations and bolster consumer protections, although there is disagreement on topics like the federal preemption of state laws and private rights of action. The majority of observers believe that there is a need for federal legislation to increase public confidence and to make the United States conform with international privacy norms (Cate & Mayer-Schönberger, 2019).

3. Better access to public information.4. The creation of new entities.

The future of privacy legislation has increasingly come to mean that more and more, citizens are demanding more control over their personal data. Modern approaches to protecting privacy are evolving from disclosure based models to rights based approaches that give consumers the power to make choices about how their information is used. This is a shift towards the awareness of people needing to have some control over their digital presence in a data-led economy (Bennett & Raab, 2020).

The following are emerging consumer rights that are expected:

Improved access to personal data rights.

Increased rights of erasure for organizations with respect to personal data.

Right to rectification of inaccuracy or incompleteness of the information.

Right to limit data processing operations.

Right to object to automated profiling and targeted advertising.

Tightened consent provisions for sensitive data use.

More transparency on the collection, sharing and monetisation of personal data.

Moreover, future laws could establish rights to obtain meaningful explanations for the results of automated decisions that have a significant impact on people, including in the fields of employment, healthcare, insurance, lending, and public services (Richards & Hartzog, 2022).

3. Artificial Intelligence Regulation

AI has become a key force in driving privacy and data governance transformation. Artificial Intelligence systems are playing a growing role in recruitment, financial services, diagnostics in healthcare, education, criminal justice and customer service. These technologies are not without their risks, however, of bias, discrimination, lack of transparency, and lack of accountability (Zuboff, 2019).

Globally, regulators are keenly considering the question of privacy laws and their implications for privacy issues arising from AI. There are many areas of concern including:

•Automated decision-making processes.

Algorithmic bias and discrimination.

Explainability and transparency of AI systems.

•Responsibility for the results of AI applications.

•The quality and equity of machine learning models.

Ethical application of biometric and facial recognition technologies.

Transparency with respect to the training sets that are input into the creation of AI.

The proposed privacy changes in Canada and current U.S. policy negotiations more and more feature provisions on responsible AI governance. With a potential algorithmic impact assessment, comprehensive documentation of automated decision making, and mechanisms for human oversight, organizations deploying AI systems may soon be expected to follow.Several of these expectations are expected to follow organizations deploying AI systems, including algorithmic impact assessments, detailed documentation of automated decision making and mechanisms for human oversight.

4. Reinforcing Rule of Cross-Border Data Transfer

Cross-border data transfers are now a major component of privacy laws, with digital services becoming a global phenomenon. Businesses regularly move personal data across country borders to help provide cloud services, customer service, cyber security, analytics and global business. But there are risks due to lack of consistency of privacy across jurisdictions for organisations dealing with international flows of data (Kuner et al., 2020).

The regulatory authorities in North America are increasingly mindful of the need for personal data sent overseas to be adequately protected, wherever it goes. The GDPR has had a profound impact on this trend, with strong implications for international data transfers. Canadian regulators, especially, are still working on making its privacy regime more compatible with international norms and standards to support international commerce and maintain adequacy relationships with key trading partners.

New laws will be more stringent for requirements of:

International transfers of data.

Vendor and third party risk management.

•Data localization considerations.

•Cross-border cybersecurity safeguards.

•Transfer impact assessments.

Outsourcing responsibility for data processing activities.

These developments are indicative of the increasing significance of converging privacy requirements in an increasingly global and interconnected economy (Greenleaf, 2023).

5. Increased Enforcement and Higher Penalties

Traditionally, North American privacy models were largely concerned with the voluntary compliance, guidance and cooperative regulation processes. But with increasing privacy concerns and the value of personal data in the economy, regulators have become more aggressive in implementing enforcement measures. These concerns are now being directed at organizations' data protection, cyber security and compliance programs (Richards & Hartzog, 2022).

Emerging trends include:

Larger administrative monetary penalties.

New investigative rights for privacy regulators.

Required Breach Notification.

•Increased audit authority.

Increased responsibility of senior management.

An improved incident reporting process after security incidents.

The tougher enforcement is meant to make privacy a management priority for organizations, not simply a legal obligation. The regulators are starting to consider monetary fines of great magnitude as a necessary tool to discourage careless or irresponsible data management (Solove & Schwartz, 2024).

Increased Corporate Privacy Accountability.

One of the hallmarks of contemporary privacy law is that it now demands that organizations take proactive action in managing privacy risks across the entire information lifecycle. Beyond just meeting regulatory requirements, organizations are being increasingly called on to integrate privacy into business processes, technology and strategic decision-making processes (Bamberger & Mulligan, 2015).

Some of the key accountability measures are:

Application of Privacy by Design principles.

•Data minimization practices.

•Privacy impact assessments.

Data protection risk assessments:

•Comprehensive governance frameworks.

Training on employee privacy.

•Third-party vendor oversight.

Incident response and breach management plans.

Board-level review of privacy and cyber security threats.

Increasingly, organizations are implementing enterprise-wide programs for privacy management that cover legal, technical, operational and ethical aspects. Evolving expectations of privacy regulations have significantly driven investments by major technology companies like Microsoft, Google and Apple in privacy engineering, cyber security infrastructure and compliance programs to keep up with the changing regulatory landscape and consumer trust. The initiatives illustrate that there is an increasing awareness that good privacy governance is not just a regulatory obligation but also a strategic business need (Westin, 2023).

8. Post-Covid Learning Attitudes and Strategies

The other new development is growing cybersecurity governance and privacy regulation convergence. Regulators know that good privacy protection requires robust information security measures. Therefore, organizations are required to put in place adequate cybersecurity measures to protect the personal information from unauthorized access, ransomware attacks, insider threats, and other cyber risks (Richards & Hartzog, 2022).

Future regulations will be more likely to focus on:

Risk management programs for cybersecurity.

Multi-factor authentication and access control.

Sensitive personal information will be encrypted.

•Continuous security monitoring.

Incident detection and incident response capabilities.

Security management in the supply chain.

With the ever-changing nature of cyber threats, privacy and cybersecurity are increasingly becoming interrelated aspects of digital governance strategies.

For North America, the future of privacy regulation is one of more uniformity towards more effective consumer protection, greater organisational accountability, tougher enforcement, and greater oversight of emerging technologies. A range of AI, global data flows, and cybersecurity issues are creating a strong push for regulatory change in the United States and Canada. Despite the regulatory fragmentation and technological complexity that persists, there is a strong trend towards the development of more holistic, transparent and risk-based privacy governance frameworks. By implementing privacy-by-design principles, enhancing governance frameworks, and building compliance capabilities, organizations can be better prepared to adapt to a changing regulatory landscape and also earn the trust of their stakeholders in the digital era.

North America is one of the world's most influential, dynamic and complex data protection markets. There are variations in the legal traditions, economic interests, and policies in the region that shape the regulatory landscape of privacy governance. Personal information protection in the digital realm is important to both the United States and Canada, but the models used to protect this information are quite dissimilar. The U.S. privacy framework is largely sectoral with a growing set of state-level privacy laws and regulations, while the Canadian model is more principles-based and places emphasis on individual rights, accountability, and transparency via federal legislation like the Personal Information Protection and Electronic Documents Act (PIPEDA) (Bennett & Raab, 2020).

The current and longstanding conflict between innovation and privacy protections in North America is an example of how both sides need to be balanced. The U.S. strategy has long been market flexibility, innovation, and industry self-regulation, meaning the industry is left with a large degree of freedom to create data-based products and services. This regulatory flexibility has helped to build key technology firms, such as the global giants, and promoted innovation in areas like artificial intelligence, cloud computing, financial technology, and digital commerce. Despite this, the lack of a comprehensive federal privacy law has introduced a level of fragmentation into the field of privacy protections, leading to uneven protections, rights, and privacy safeguards across industries, regions, and personal information types (Solove & Schwartz, 2024).

The Canadian approach, on the other hand, is one that delivers a more consistent method to privacy governance with extensive federal oversight and well-defined principles for collecting, using, and disclosing personal information. This approach is more in line with the international privacy principles that have enabled better interaction with other global privacy laws, notably those of the European Union. However, there are also some challenges for Canada that come from rapidly changing technologies, information exchanges across borders and the need to update current laws to better deal with new digital risks (Kuner, Bygrave, & Docksey, 2020).

The one thing that stands out from this chapter is the complexity of compliance becoming more complex for organizations doing business globally across North America. The regulatory landscape is becoming increasingly complex, with businesses having to deal with a variety of federal, state, industry-specific, contractual, and international regulations. This complexity is especially seen in the USA with the proliferation of state legislation, resulting in a patchwork of laws that must be satisfied by organizations with complex privacy governance programs (Greenleaf, 2023). Thus, privacy management is no longer just limited to a legal compliance role, but has become a core organizational concern, including risk management, corporate governance, cybersecurity, ethical issues and trust-building with stakeholders.

The privacy environment in North America has been further influenced by the advent of artificial intelligence, machine learning, big data analytics, biometric technologies and the Internet of Things. While these technologies offer unprecedented opportunities for innovation, efficiency and economic growth, they also bring new challenges in terms of surveillance, profiling, algorithmic bias, transparency and accountability. The regulators are growing increasingly aware that traditional privacy regimes might not be adequate to cope with the dangers of automated decision-making systems and sophisticated data-processing technology. This has led to a search for new regulatory frameworks that facilitate responsible innovation while maintaining privacy rights (Richards & Hartzog, 2022).

The growing focus on consumer empowerment and individual rights is another key development. In the U.S. and Canada, there seems to be a clear trend of giving people more rights over their personal data – access, correction, deletion, portability and transparency (ATPD). These developments rather represent the wider society's perceptions of self-sufficiency and the rightful use of personal information in a digital context. Organizations are expected to not only meet legal requirements but also to show responsible stewardship of information assets and how they use and govern data in ways that foster trust in the public by being transparent and accountable (Westin, 2023).

Another hot topic in North American privacy law is cross-border data transfers. In today's globalized economy, businesses are regularly exchanging personal data between countries to enable business functions, cloud services and global trade. Making these transfers secure and in compliance with the relevant law is a substantial regulatory hurdle. International frameworks are likely to continue to impact North American privacy policies and foster data protection harmonization across jurisdictions, especially with the European Union's GDPR (Kuner et al., 2020).

In the years to come, the North American landscape is likely to see further changes in regulation as governments adapt to emerging technology-related dangers and societal expectations for privacy safeguards. Additional developments include more powerful consumer rights, expanded enforcement capabilities, greater obligations for corporate accountability, more robust approaches to AI governance, and perhaps even a single federal privacy law in the United States. Overall, the trends indicate a commitment to continuous improvement and alignment with international privacy regulations, all while maintaining the competitiveness and innovation that characterize the region (Greenleaf, 2023).

To sum up, the data protection landscape in North America underscores the intricate balance between privacy, technology, economic growth, and governance in the digital age. There are still considerable differences between the regulatory regimes of the United States and Canada; but both are responding to the new realities of the data-driven world. Effective privacy governance will be vital to safeguarding individual rights, driving innovation, retaining consumer trust and promoting the growth of digital ecosystems sustainably in the context of digital transformation's influence on economies and societies. The lessons learned from North America highlight the complexities and opportunities that lie in the delicate trade-off between privacy and advancements in twenty-first century technology.

The following chapter will turn to African, Latin American and Middle Eastern approaches to data protection, and how new economies are creating privacy laws and digital governance policies to meet the challenges and opportunities arising from the swift pace of technological change, the growing nature of digital economies, and the rise of global data flows.