American Data Privacy and Protection Act: Difference between revisions
GoingBatty (talk | contribs) →Contents: fixed link and typo |
GoingBatty (talk | contribs) →top: General fixes, added orphan tag |
||
| Line 1: | Line 1: | ||
{{short description|United States proposed federal privacy bill}} |
{{short description|United States proposed federal privacy bill}} |
||
{{Orphan|date=July 2022}} |
|||
{{Use American English|date=July 2022}} |
{{Use American English|date=July 2022}} |
||
{{Use mdy dates|date=July 2022}} |
{{Use mdy dates|date=July 2022}} |
||
Revision as of 13:44, 31 July 2022
.svg) | |
| Long title | An act to provide consumers with foundational data privacy rights, create strong oversight mechanisms, and establish meaningful enforcement |
|---|---|
| Acronyms (colloquial) | ADPPA |
| Legislative history | |
| |
American Data Privacy and Protection Act (ADPPA) is a United States proposed federal privacy bill that would regulate how organizations keep and use consumer data. The bipartisan, bicameral bill is the first American consumer privacy bill to pass committee markup, which it did with near unanimity.
Contents
The American Data Privacy and Protection Act (ADPPA) would regulate how organizations keep and use consumer data. The Act has several main principles: data minimization, individual ownership, and private right of action. The burden of evaluating each organization's programs would fall to the organization.[1]
Data collectors would have to minimize the data they collect down to that which is "necessary, proportionate, and limited to" their purpose, whether administering a product or communicating. The bill would give the Federal Trade Commission a year to define those terms. Data minimization is a common principle among other privacy laws but would affect business functions beyond compliance operations. ADPPA would also specifically limit transfer and some processing of Social Security numbers, precise geolocation, biometric and genetic data, passwords, browsing history, and physical activity tracking.[1]
Individuals would have the right to know how their personal data will be used and which third parties receive it. They would have the right to correct and download their user data. Organizations would have up to 90 days to process these requests, depending on the organization's size. Individuals would also have the right to take legal action against organizations in violation of the Act for four years after its execution after first giving their state Attorney General and Federal Trade Commission 60 days' notice to respond.[1]
Designated "large data holders"—with adjusted gross revenue over $250 million in the last calendar year and processing either five million personal records or 100,000 sensitive individual records—would be subject to additional controls. These organizations would have to designate a corporate officer for administering data policy, training employees, keeping records, and communicating with the government. Large data holders' highest ranking corporate officers and data security officers would have to certify reasonable compliance with the Federal Trade Commission. Large data holders would need to provide a privacy impact assessment of their controls and risk to users every two years.[1]
"Small data holders", on the other hand, would be exempt from some requirements. Defined as organizations with adjusted gross revenue below $41 million over the past three calendar years, that process data for fewer than 100,000 individuals annually, and whose business does not primarily rely on transferring data, small data holders could delete records rather than processing corrective requests and would be exempt from many requirements apart from the user right to delete data no longer in use.[1]
Third-party data collectors, whose primary business revenue comes from user data collected for another platform's use, would also be subject to specific rules, such as displaying a notice about data collected on behalf of another organization, allowing for data audits, and populating a registry for such data collectors.[1]
As the first federal user data privacy legislation, ADPPA would largely supersede state laws like the California Consumer Privacy Act and Colorado Privacy Act, though carve-out state provisions about biometric data and data breaches would be protected. The federal bill would include nonprofit organizations whereas many state privacy laws do not, though nonprofits would largely fall under the "small data holder" exemptions.[1]
History
By July 2022, the bicameral bill had bipartisan support and had included bipartisan concessions that had restricted prior attempts at a bipartisan privacy bill. While Consumer Reports and the Electronic Privacy Information Center both showed optimism towards the bill, several democratic senators still opposed the bill. It became the first American consumer privacy bill to pass committee markup, which it did with near unanimity.[2]
The 2022 overturning of Roe v. Wade led to increased interest in a federal privacy bill, with concern over how unmitigated tracking by data brokers and app developers, such as user visits to abortion clinics or period app usage, could be used to target users in places where criminalization of abortion. ADPPA would protect health privacy and not directly address Roe.[2]
Other privacy-related bills during ADPPA's advancement have included Elizabeth Warren's Health and Location Data Protection Act, Suzan DelBene's Information Transparency and Personal Data Control Act, and Sara Jacobs's My Body, My Data Act. In the absence of federal legislation, states laws have included California's Consumer Privacy Act and Privacy Rights Acts, Illinois's Biometric Information Privacy Act, and Vermont's Data Broker Act.[2]
References
- ^ a b c d e f g Dumiak, Matt (June 24, 2022). "Federal Privacy Bill: Breaking Down the ADPPA". JD Supra. Archived from the original on June 25, 2022. Retrieved July 30, 2022.
- ^ a b c Morrison, Sara (July 21, 2022). "The end of Roe could finally convince Americans to care more about privacy". Vox. Archived from the original on July 27, 2022. Retrieved July 30, 2022.
Further reading
- Castro, Daniel (June 13, 2022). "A Review: The American Data Privacy and Protection Act". GovTech. Archived from the original on July 17, 2022. Retrieved July 30, 2022.
- Edelman, Gilad (July 21, 2022). "Congress Might Pass an Actually Good Privacy Bill". Wired. ISSN 1059-1028. Archived from the original on July 29, 2022. Retrieved July 29, 2022.
- Keary, Tim (June 20, 2022). "What is the American Data Privacy and Protection Act (ADPPA) and what does it mean to enterprises?". VentureBeat. Archived from the original on July 27, 2022. Retrieved July 30, 2022.
- Klar, Rebecca (July 20, 2022). "House panel advances landmark federal data privacy bill". The Hill. Retrieved July 30, 2022.
- Lima, Cristiano (July 26, 2022). "Analysis - Pelosi in a bind as California leaders object to federal privacy bill". Washington Post. ISSN 0190-8286. Archived from the original on July 26, 2022. Retrieved July 30, 2022.
- McKinnon, John D. (July 20, 2020). "Data-Privacy Bill Advances in Congress, but States Throw Up Objections". Wall Street Journal. Archived from the original on July 20, 2022. Retrieved July 30, 2022.
- Ostwal, Trishla (July 21, 2022). "States Retaliate as the Federal Privacy Bill Advances". Adweek. Retrieved July 30, 2022.
- Seitz, Jacob (July 21, 2022). "Congress' big new privacy bill might just neuter the agency that should be enforcing it". The Daily Dot. Retrieved July 30, 2022.
- Shatz, Sanford (July 12, 2022). "Congress Introduces the American Data Privacy and Protection Act". JD Supra. Archived from the original on July 14, 2022. Retrieved July 30, 2022.
- Tsukayama, Hayley; Schwartz, Adam; McKinney, India; Tien, Lee (July 24, 2022). "Americans Deserve More Than The Current American Data Privacy Protection Act". Electronic Frontier Foundation. Archived from the original on July 29, 2022. Retrieved July 30, 2022.
