What are the key principles that apply to the processing of personal data?

Transparency: The FTC has issued guidelines espousing the principle of transparency, recommending that businesses: $($i$)$ provide clearer, shorter, and more standardised privacy notices that enable consumers to better comprehend privacy practices; $($ii$)$ provide reasonable access to the consumer data they maintain that is proportionate to the sensitivity of the data and the nature of its use; and $($iii$)$ expand efforts to educate consumers about commercial data privacy practices.

Lawful basis for processing: While there is no $$lawful basis for processing$$ requirement under U$.$S$.$ law, the FTC recommends that businesses provide notice to consumers of their data collection, use and sharing practices and obtain consent in limited circumstances where the use of consumer data is materially different than claimed when the data was collected, or where sensitive data is collected for certain purposes. Certain new state laws require obtaining consent in certain circumstances, such as prior to processing sensitive personal data.

Purpose limitation: The FTC recommends privacy$-$by$-$design practices that include limiting $$data collection to that which is consistent with the context of a particular transaction or the consumer$$s relationship with the business, or as required or specifically authorized by law$.$

Data minimisation: See above.

Proportionality: See above.

Retention: The FTC recommends privacy$-$by$-$design practices that implement $$reasonable restrictions on the retention of data$,$ including disposal $$once the data has outlived the legitimate purpose for which it was collected$.$ Additionally, state laws may also specify specific retention parameters, for example, Texas$$s Capture or Use of Biometric Identifier Act $($CUBI$)$ requires the destruction of biometric identifiers within a reasonable time, but not more than a year after the purpose for capturing the biometric identifiers has ended