A new US data privacy bill aims to give more control over information collected – and make businesses change how data are handled
Data privacy in the U.S. is, in many ways, a legal void. While there are limited protections for health and financial data, the cradle of the world’s largest tech companies, like Apple, Amazon, Google, and Meta (Facebook), lacks any comprehensive federal data privacy law. This leaves U.S. citizens with minimal data privacy protections compared with citizens of other nations. But that may be about to change.
With rare bipartisan support, the American Data and Privacy Protection Act moved out of the U.S. House of Representatives Committee on Energy and Commerce by a vote of 53-2 on July 20, 2022. The bill still needs to pass the full House and the Senate, and negotiations are ongoing. Given the Biden administration’s responsible data practices strategy, White House support is likely if a version of the bill passes.
ADPPA (American Data and Privacy Protection Act) would apply to “covered” entities, meaning any entity collecting, processing or transferring covered data, including nonprofits and sole proprietors. It also regulates cellphone and internet providers and other common carriers, with potentially concerning changes to federal communications regulation. It does not apply to government entities.
ADPPA defines “covered” data as any information or device that identifies or can be reasonably linked to a person. It also protects biometric data, genetic data and geolocation information.
The bill excludes three big data categories: deidentified data, employee data and publicly available information. That last category includes social media accounts with privacy settings open to public viewing. While research has repeatedly shown deidentified data can be easily reidentified, the ADPPA attempts to address that by requiring covered entities to take “reasonable technical, administrative, and physical measures to ensure that the information cannot, at any point, be used to re-identify any individual or device.”
The ADPPA also has a provision that tackles the service-conditioned-on-consent problem – those annoying “I Agree” boxes that force people to accept a jumble of legal terms. When you click one of those boxes, you contractually waive your privacy rights as a condition to simply use a service, visit a website or buy a product. The bill will prevent covered entities from using contract law to get around the bill’s protections.
Looking to federal electronic surveillance law for guidance
The U.S.’s Electronic Communications Privacy Act (ECPA) can provide federal law makers guidance in finalizing ADPPA. Like the ADPPA, the 1986 ECPA legislation involved a massive overhaul of U.S. electronic privacy law to address adverse effects to individual privacy and civil liberties posed by advancing surveillance and communication technologies.
National preemption
As drafted, ADPPA preempts some state data privacy legislation. This affects California’s Consumer Privacy Act, although it does not preempt the Illinois Biometric Information Privacy Act or state laws specifically regulating facial recognition technology. The preemption provisions, however, are in flux as members of the House continue to negotiate the bill.
ADPPA’s national standards provide uniform compliance requirements, serving economic efficiency; but its preemption of most state laws has some scholars concerned, and California opposes its passage.
If preemption stands, any final version of the ADPPA will be the law of the land, limiting states from more firmly protecting their citizens’ data privacy.
How big are the changes?
The changes to U.S. data privacy law are big, but ADPPA affords much-needed security and data protections to U.S. citizens.
Given how the internet works, data routinely flows across international borders, so many U.S. companies have already built compliance with other nations’ laws into their systems. This includes the E.U.’s General Data Protection Regulation (GDPR)– a law similar to the ADPPA. Facebook, for example, provides E.U. citizens with GDPR’s protections, but it does not give U.S. citizens those protections, because it is not required to do so.
Congress has done little with data privacy, but ADPPA is poised to change that.
Source: TheConversation
