Wikipedia

American Privacy Rights Act

The American Privacy Rights Act (APRA) is a comprehensive data privacy law proposed in the United States. It would place limitations on the kinds of data companies can collect about their users, create processes for users to access or remove data about them, and allow users opt-out from having data sold by data brokers. The bipartisan proposal was introduced in April 2024 by Senator Maria Cantwell (D-WA), and Representative Cathy McMorris Rodgers (R-WA). Cantwell is Chair of the Senate Committee on Commerce, Science, and Transportation and McMorris Rodgers is Chair of the House Committee on Energy and Commerce. If passed, it would supersede a collection of state-based laws which have emerged in the absence of a comprehensive federal data privacy law.

Background edit

The Constitution of the United States and the United States Bill of Rights do not explicitly include a right to privacy, no federal law takes a holistic approach to privacy legislation, and the US has no national data protection authority.[1] It is the only G20 country without such a law.[2] As a result, in most states and for most companies there are no limits to how they use, share, or sell their users data and no requirements to notify users when or how they do so.[3]

The laws which have been passed focus on specific types of data or specific populations of data subjects. The Privacy Act of 1974, the Health Insurance Portability and Accountability Act (HIPPA) of 1996, and the Children's Online Privacy Protection Act (COPPA) of 1998, for example, regulate the use of data by federal agencies, how patients' health data is communicated, and aspects of collecting data about children.[4][5] In the absence of a federal data privacy law, several states have passed laws to like the 2008 Biometric Information Privacy Act in Illinois and the 2018 California Consumer Privacy Act (CCPA).[5] As of 2021, only California, Colorado, and Virginia had enacted comprehensive data privacy legislation.[3] Proponents of broad data privacy legislation argue that it provides a more effective and durable solution to the problems many narrower bills attempt to address through focus on specific companies like TikTok.[6]

There have been multiple attempts to pass a comprehensive data privacy law, such as the Personal Data Privacy and Security Act of 2009 and the American Data Privacy and Protection Act (ADPPA) in 2022. Both had bipartisan support and passed committees, but were not brought up for a vote.[7][8][9] A common sticking point in debates over these laws is the relationship between the federal law and current or future state laws.[10] There has also been disagreement about enforcement, including whether users could use the laws as a basis to sue companies directly for privacy violations.[11] Senator Cantwell, one of the lawmakers behind the APRA, opposed the ADPPA on the basis of its enforcement.[12]

The idea of a comprehensive federal data protection law gained increased attention and support in the early 2020s.[13] Privacy experts, technologist journalists, and consumer advocacy organizations have spoken in support of ADPPA and others, like APRA, which focus on "data minimization" rather than "notice and consent" ("notice and choice") frameworks.[14][15] Notice and consent is the standard by which a company displays a notification to users inviting them to read lengthy legal documents about their use of data and asking them to accept the terms in order to continue using the website or application. It has been widely criticized for its failure to provide real protections for user privacy.[16][17] Data minimization places limits on what data can be collected in the first place rather than simply dictate how use of data is communicated.[17][13] US President Joe Biden included the importance of such a data privacy law in his 2023 State of the Union address.[18]

Provisions edit

The American Privacy Rights Act would create limitations on the kinds of data companies can collect about their users.[19][12][20] It includes provisions to give users the ability to access the data companies have about them as well as to make changes or remove such data and restricts the ability of companies to impose mandatory arbitration. It creates a registry for data brokers and includes opt-out procedures for consumers who do not want their data sold or used for personalized advertising.[11][19]

APRA expands some of the California law's enforcement mechanisms, enabling not just the Federal Trade Commission (FTC) to take legal action against violators, but also state attorneys general and private citizens.[11] Except in cases of a "substantial privacy harm", companies have a 30-day window after being notified of a violation to make a correction.[12]

The legislation would apply to businesses that sell users data or which have more than $40 million in annual revenue, intended to apply primarily to those with greater than $250 million in revenue ("large data holders").[21][11]

Legislative history edit

 
 
Democratic Senator Maria Cantwell (left) and Republican Representative Cathy McMorris Rodgers (right) introduced the legislation.

The bipartisan proposal was introduced in April 2024 by two Washington lawmakers, Senator Maria Cantwell and Representative Cathy McMorris Rodgers.[10] Cantwell is a Democrat who serves as Chair of the Senate Committee on Commerce, Science, and Transportation and McMorris Rodgers is a Republican who chairs the House Committee on Energy and Commerce.[19] Cantwell did not support the ADPPA, which is part of why that legislation stalled, according to The Verge.[12] She wanted individuals to be more empowered to sue companies for violating their privacy rights. In that and other ways, some state laws took privacy measures further than the ADPPA, leading to some Democratic opposition for the way the federal policy would supersede the states. APRA would still override most of the state laws, but was written to incorporate elements of those laws in part to overcome such objections.[22]

Reception edit

According to The Washington Post, the law is a "major breakthrough" in an "issue that has befuddled lawmakers despite near-universal agreement -- in Silicon Valley and in Washington -- on the need for federal standards to determine how much information companies can collect from consumers online".[22]

McMorris Rodgers' Democratic counterpart on the House committee, Frank Pallone of New Jersey, called the draft "very strong" but said he wanted to see greater protections applied to children.[12] Representative Jan Schakowsky, Ranking Member on the committee's Innovation, Data, and Commerce subcommittee, expressed optimism about the proposal and cited "an urgency that's felt to get this done".[6]

The digital rights advocacy organization Electronic Frontier Foundation was positive about the basic components of the bill, but presented many ways in which the bill should be strengthened or modified to increase consumer protections, including allowing states to pass more strict laws and limiting the extent to which companies can share data with the government.[23]

Advertising industry advocates expressed concern at the way restrictions on data security and targeted advertising could affect dominant business models.[24]

References edit

  1. ^ "The Right of Privacy The Issue: Does the Constitution protect the right of privacy? If so, what aspects of privacy receive protection?". University of Missouri – Kansas City School of Law. Archived from the original on September 8, 2020. Retrieved September 29, 2020.
  2. ^ Roose, Kevin; Newton, Casey; Land, Davis; Cohn, Rachel; Jones, Whitney; Poyant, Jen; Moxley, Alyssa; Powell, Dan; Niemisto, Rowan (April 12, 2024). "A.I.'s Data Wall, a Surprise Privacy Bill, and What Happened to the TikTok Ban?". The New York Times. ISSN 0362-4331. Archived from the original on April 20, 2024. Retrieved April 20, 2024.
  3. ^ a b "The State of Consumer Data Privacy Laws in the US (And Why It Matters)". Wirecutter. September 6, 2021. Archived from the original on April 13, 2024. Retrieved April 12, 2024.
  4. ^ "Senators reintroduce COPPA 2.0 bill to tighten child safety online". Engadget. May 3, 2023. Archived from the original on February 18, 2024. Retrieved April 12, 2024.
  5. ^ a b Murray, Conor. "U.S. Data Privacy Protection Laws: A Comprehensive Guide". Forbes. Archived from the original on April 8, 2024. Retrieved April 12, 2024.
  6. ^ a b Feiner, Lauren (April 17, 2024). "A real privacy law? House lawmakers are optimistic this time". The Verge. Archived from the original on April 19, 2024. Retrieved April 20, 2024.
  7. ^ "Personal Data Privacy and Security Act of 2009 (2009 - S. 1490)". GovTrack.us. Archived from the original on October 9, 2022. Retrieved April 12, 2024.
  8. ^ "What's Stopping the American Data Privacy Act From Passing?". Gizmodo. August 18, 2022. Archived from the original on September 26, 2023. Retrieved April 12, 2024.
  9. ^ McGill, Margaret Harding (August 4, 2022). "Online privacy bill faces daunting roadblocks". Axios. Archived from the original on April 9, 2024. Retrieved April 12, 2024.
  10. ^ a b Fung, Brian (April 8, 2024). "US lawmakers unveil a plan to give all Americans a right to online privacy | CNN Business". CNN. Archived from the original on April 12, 2024. Retrieved April 12, 2024.
  11. ^ a b c d Kelly, Makena. "A Breakthrough Online Privacy Proposal Hits Congress". Wired. ISSN 1059-1028. Archived from the original on April 12, 2024. Retrieved April 12, 2024.
  12. ^ a b c d e Feiner, Lauren (April 8, 2024). "Lawmakers unveil new bipartisan digital privacy bill after years of impasse". The Verge. Archived from the original on April 11, 2024. Retrieved April 12, 2024.
  13. ^ a b Edelman, Gilad. "Congress Might Pass an Actually Good Privacy Bill". Wired. ISSN 1059-1028. Archived from the original on July 29, 2022. Retrieved April 12, 2024.
  14. ^ Klar, Rebecca (April 9, 2024). "5 things to know about the bipartisan data privacy bill". The Hill. Archived from the original on April 12, 2024. Retrieved April 12, 2024.
  15. ^ Jerome, Joseph (April 11, 2024). "Can the American Privacy Rights Act Accomplish Data Minimization? | TechPolicy.Press". Tech Policy Press. Archived from the original on April 11, 2024. Retrieved April 12, 2024.
  16. ^ "Companies, not people, should bear the burden of protecting data". Brookings. Archived from the original on December 9, 2023. Retrieved April 12, 2024.
  17. ^ a b "How "Notice and Consent" Fails to Protect Our Privacy". New America. Archived from the original on April 18, 2024. Retrieved April 12, 2024.
  18. ^ Newman, Lily Hay. "Data Privacy Is Now a Must-Hit US State of the Union Topic". Wired. ISSN 1059-1028. Archived from the original on April 10, 2024. Retrieved April 12, 2024.
  19. ^ a b c "Cantwell, McMorris Rodgers strike bipartisan deal on landmark data privacy bill | The Spokesman-Review". www.spokesman.com. Archived from the original on April 11, 2024. Retrieved April 12, 2024.
  20. ^ "Bipartisan bill would strengthen data privacy protections". NewsNation. April 18, 2024. Archived from the original on April 20, 2024. Retrieved April 20, 2024.
  21. ^ "The American Privacy Rights Act of 2024: Section-by-Section Summary". United States Senate Committee on Commerce, Science, & Transportation. 2024. Archived from the original on April 13, 2024. Retrieved April 12, 2024.
  22. ^ a b Lima-Strong, Cristiano (April 7, 2024). "Lawmakers unveil sprawling plan to expand online privacy protections". Washington Post. Archived from the original on April 7, 2024. Retrieved April 12, 2024.
  23. ^ Trujillo, Mario (April 16, 2024). "Americans Deserve More Than the Current American Privacy Rights Act". Electronic Frontier Foundation. Archived from the original on April 19, 2024. Retrieved April 20, 2024.
  24. ^ Sloane, Garett (April 19, 2024). "Ad Targeting May Be Banned--Inside the US Privacy Proposal That Could Jeopardize the Marketing Tactic". Ad Age. Archived from the original on April 20, 2024. Retrieved April 20, 2024.

External links edit

Retrieved from "https://en.wikipedia.org/w/index.php?title=American_Privacy_Rights_Act&oldid=1222061916"