Wikipedia

American Privacy Rights Act

The American Privacy Rights Act (APRA) is a comprehensive data privacy law proposed in the United States. It would place limitations on the kinds of data companies can collect about their users, create processes for users to access or remove data about them, and allow users opt-out from having data sold by data brokers. The bipartisan proposal was introduced in April 2024 by Senator Maria Cantwell (D-WA), and Representative Cathy McMorris Rodgers (R-WA). Cantwell is Chair of the Senate Committee on Commerce, Science, and Transportation and McMorris Rodgers is Chair of the House Committee on Energy and Commerce. If passed, it would supersede some state-based laws which have emerged in the absence of a comprehensive federal data privacy law. The bill underwent controversial revisions in June 2024, removing several consumer protections under pressure from House Republicans, including a section about civil rights. The changes led many privacy and civil society organizations to withdraw support, and the June 27, 2024, committee markup session was canceled amid signals from Republicans that they would kill the bill if it got out of committee.

Background

edit

Data privacy in the United States

edit

The Constitution of the United States and the United States Bill of Rights do not explicitly include a right to privacy, no federal law takes a holistic approach to privacy legislation, and the US has no national data protection authority.[1] It is the only G20 country without such a law.[2] As a result, in most states and for most companies there are no limits to how they use, share, or sell their users' data and no requirements to notify users when or how they do so.[3]

The laws which have been passed focus on specific types of data or specific populations of data subjects. The Privacy Act of 1974, the Health Insurance Portability and Accountability Act (HIPAA) of 1996, and the Children's Online Privacy Protection Act (COPPA) of 1998, for example, regulate the use of data by federal agencies, how patients' health data is communicated, and aspects of collecting data about children.[4][5] In the absence of a federal data privacy law, several states have passed laws to like the 2008 Biometric Information Privacy Act in Illinois and the 2018 California Consumer Privacy Act (CCPA).[5] As of 2021, only California, Colorado, and Virginia had enacted comprehensive data privacy legislation.[3] Proponents of broad data privacy legislation argue that it provides a more effective and durable solution to the problems many narrower bills attempt to address through focus on specific companies like TikTok.[6]

Previous comprehensive data privacy bills

edit

There have been multiple attempts to pass a comprehensive data privacy law, such as the Personal Data Privacy and Security Act of 2009 and the American Data Privacy and Protection Act (ADPPA) in 2022. Both had bipartisan support and passed committees, but were not brought up for a vote.[7][8][9] A common sticking point in debates over these laws is the relationship between the federal law and current or future state laws.[10] While the first draft of the APRA would have superseded state privacy laws, a June 2024 revision clarified state laws could place more stringent regulations on privacy.[11] There has also been disagreement about enforcement, including whether users could use the laws as a basis to sue companies directly for privacy violations.[12] Senator Cantwell, one of the lawmakers behind the APRA, opposed the ADPPA on the basis of its enforcement.[13]

The idea of a comprehensive federal data protection law gained increased attention and support in the early 2020s.[14] Privacy experts, technologist journalists, and consumer advocacy organizations have spoken in support of ADPPA and others, like APRA, which focus on "data minimization" rather than "notice and consent" ("notice and choice") frameworks.[15][16][17] Notice and consent is the standard, widely criticized for its failure to provide real protections for user privacy, by which a company displays a notification to users inviting them to read lengthy legal documents about their use of data and asking them to accept the terms in order to continue using the website or application.[18][19] Data minimization places limits on what data can be collected in the first place rather than simply dictate how use of data is communicated.[19][14] US President Joe Biden included the importance of such a data privacy law in his 2023 State of the Union address.[20]

Legislative history

edit
 
 
Democratic Senator Maria Cantwell (left) and Republican Representative Cathy McMorris Rodgers (right) introduced the legislation.

The bipartisan proposal was introduced in April 2024 by two Washington lawmakers, Senator Maria Cantwell and Representative Cathy McMorris Rodgers.[10] Cantwell is a Democrat who serves as Chair of the Senate Committee on Commerce, Science, and Transportation and McMorris Rodgers is a Republican who chairs the House Committee on Energy and Commerce.[21] Cantwell did not support the ADPPA, which is part of why that legislation stalled, according to The Verge.[13] She wanted individuals to be more empowered to sue companies for violating their privacy rights (a private right of action). In that and other ways, some state laws took privacy measures further than the ADPPA, leading to some Democratic opposition for the way the federal policy would supersede the states. The initial draft of APRA would have still overridden most of the state laws, but was written to incorporate elements of those laws in part to overcome such objections.[22]

The bill underwent a series of revisions prior to being shared in early June 2024. Those revisions made concessions to Republican lawmakers that were poorly received by privacy advocates. The bill was introduced as H.R. 8818 on June 25, 2024 and scheduled for markup to begin on June 27.[23] When the markup date arrived, the session was canceled amid reports that Republican leaders had signaled they would not permit the bill to move forward regardless of committee decisions.[24][25]

Provisions

edit

The American Privacy Rights Act would create limitations on the kinds of data companies can collect about their users.[21][13][26] It includes provisions to give users the ability to access the data companies have about them as well as to make changes or remove such data and restricts the ability of companies to impose mandatory arbitration. It creates a registry for data brokers and includes opt-out procedures for consumers who do not want their data sold or used for personalized advertising.[12][21]

APRA expands some of the California law's enforcement mechanisms, enabling not just the Federal Trade Commission (FTC) to take legal action against violators, but also state attorneys general and private citizens.[12] Except in cases of a "substantial privacy harm", companies have a 30-day window after being notified of a violation to make a correction.[13]

The legislation would apply to businesses that sell users data or which have more than $40 million in annual revenue, intended to apply primarily to those with greater than $250 million in revenue ("large data holders").[27][28]

June 2024 revisions

edit

In June 2024, prior to a committee markup session, the bill was subject to several controversial revisions. Under pressure from Republican lawmakers, a section on civil rights protections was removed. Sections on AI and algorithms were also cut, as was an enforcement mechanism through the Federal Trade Commission.[11][29][30] The changes also weakened data minimization principles, regarding data kept on a user's device as exempt.[11] The extent to which the bill preempts state privacy laws changed as well, preempting only those laws with a scope similar to the APRA but allowing states to have stricter or more specific requirements. Other sections were added or expanded, such as new "Privacy By Design" requirements, additional obligations for data brokers, and a provision to allow users to request humans make "consequential decisions" rather than algorithms.[29]

Reception

edit

Original draft

edit

According to The Washington Post in April 2024, the law is a "major breakthrough" in an "issue that has befuddled lawmakers despite near-universal agreement -- in Silicon Valley and in Washington -- on the need for federal standards to determine how much information companies can collect from consumers online".[22]

McMorris Rodgers' Democratic counterpart on the House committee, Frank Pallone of New Jersey, called the draft "very strong" but said he wanted to see greater protections applied to children.[13] Representative Jan Schakowsky, Ranking Member on the committee's Innovation, Data, and Commerce subcommittee, expressed optimism about the proposal and cited "an urgency that's felt to get this done".[6]

The digital rights advocacy organization Electronic Frontier Foundation was positive about the basic components of the bill, but presented many ways in which the bill should be strengthened or modified to increase consumer protections, including allowing states to pass more strict laws and limiting the extent to which companies can share data with the government.[31]

Stewart Baker, in the Volokh Conspiracy, criticized the bill's requirement that companies assess the extent to which their algorithms harm certain groups more than others and document any measures they take to mitigate such harms. Baker argued that efforts to curb discrimination would themselves lead to discrimination against other groups.[32] Advertising industry advocates and other critics expressed concern at the way restrictions on data security and targeted advertising could affect dominant business models, creating a situation that larger companies may be better able to adapt to than small businesses.[33][34]

June 2024 revisions

edit

The June 2024 revisions were poorly received by privacy rights groups. The removal of civil rights protections provisions in particular led dozens of data privacy, internet rights, and civil rights groups to express objections or withdraw support. The American Civil Liberties Union, Center for Democracy and Technology, and the NAACP, for example, issued critical statements.[24] According to Wired, the new version was "engineered to appease conservative lobbyists representing the interests of big business," but even after the changes, Republican leadership signaled they would not support it even with the changes, leading the markup session to be canceled. House Majority Leader Steve Scalise named the private right of action as a point of contention, which remained after the changes.[25][24]

References

edit
  1. ^ "The Right of Privacy The Issue: Does the Constitution protect the right of privacy? If so, what aspects of privacy receive protection?". University of Missouri – Kansas City School of Law. Archived from the original on September 8, 2020. Retrieved September 29, 2020.
  2. ^ Roose, Kevin; Newton, Casey; Land, Davis; Cohn, Rachel; Jones, Whitney; Poyant, Jen; Moxley, Alyssa; Powell, Dan; Niemisto, Rowan (April 12, 2024). "A.I.'s Data Wall, a Surprise Privacy Bill, and What Happened to the TikTok Ban?". The New York Times. ISSN 0362-4331. Archived from the original on April 20, 2024. Retrieved April 20, 2024.
  3. ^ a b "The State of Consumer Data Privacy Laws in the US (And Why It Matters)". Wirecutter. September 6, 2021. Archived from the original on April 13, 2024. Retrieved April 12, 2024.
  4. ^ "Senators reintroduce COPPA 2.0 bill to tighten child safety online". Engadget. May 3, 2023. Archived from the original on February 18, 2024. Retrieved April 12, 2024.
  5. ^ a b Murray, Conor. "U.S. Data Privacy Protection Laws: A Comprehensive Guide". Forbes. Archived from the original on April 8, 2024. Retrieved April 12, 2024.
  6. ^ a b Feiner, Lauren (April 17, 2024). "A real privacy law? House lawmakers are optimistic this time". The Verge. Archived from the original on April 19, 2024. Retrieved April 20, 2024.
  7. ^ "Personal Data Privacy and Security Act of 2009 (2009 - S. 1490)". GovTrack.us. Archived from the original on October 9, 2022. Retrieved April 12, 2024.
  8. ^ "What's Stopping the American Data Privacy Act From Passing?". Gizmodo. August 18, 2022. Archived from the original on September 26, 2023. Retrieved April 12, 2024.
  9. ^ McGill, Margaret Harding (August 4, 2022). "Online privacy bill faces daunting roadblocks". Axios. Archived from the original on April 9, 2024. Retrieved April 12, 2024.
  10. ^ a b Fung, Brian (April 8, 2024). "US lawmakers unveil a plan to give all Americans a right to online privacy | CNN Business". CNN. Archived from the original on April 12, 2024. Retrieved April 12, 2024.
  11. ^ a b c Gold, Ashley; Curi, Maria (June 24, 2024). "What's changed in the American Privacy Rights Act". Axios. Archived from the original on June 25, 2024. Retrieved June 25, 2024.
  12. ^ a b c Kelly, Makena. "A Breakthrough Online Privacy Proposal Hits Congress". Wired. ISSN 1059-1028. Archived from the original on April 12, 2024. Retrieved April 12, 2024.
  13. ^ a b c d e Feiner, Lauren (April 8, 2024). "Lawmakers unveil new bipartisan digital privacy bill after years of impasse". The Verge. Archived from the original on April 11, 2024. Retrieved April 12, 2024.
  14. ^ a b Edelman, Gilad. "Congress Might Pass an Actually Good Privacy Bill". Wired. ISSN 1059-1028. Archived from the original on July 29, 2022. Retrieved April 12, 2024.
  15. ^ Klar, Rebecca (April 9, 2024). "5 things to know about the bipartisan data privacy bill". The Hill. Archived from the original on April 12, 2024. Retrieved April 12, 2024.
  16. ^ Jerome, Joseph (April 11, 2024). "Can the American Privacy Rights Act Accomplish Data Minimization? | TechPolicy.Press". Tech Policy Press. Archived from the original on April 11, 2024. Retrieved April 12, 2024.
  17. ^ Miller, Gabby; Lennett, Ben (May 24, 2024). "American Privacy Rights Act, Kids Online Safety Act Marked Up in House Energy & Commerce Subcommittee | TechPolicy.Press". Tech Policy Press. Archived from the original on June 29, 2024. Retrieved June 25, 2024.
  18. ^ "Companies, not people, should bear the burden of protecting data". Brookings Institution. Archived from the original on December 9, 2023. Retrieved April 12, 2024.
  19. ^ a b "How "Notice and Consent" Fails to Protect Our Privacy". New America. Archived from the original on April 18, 2024. Retrieved April 12, 2024.
  20. ^ Newman, Lily Hay. "Data Privacy Is Now a Must-Hit US State of the Union Topic". Wired. ISSN 1059-1028. Archived from the original on April 10, 2024. Retrieved April 12, 2024.
  21. ^ a b c "Cantwell, McMorris Rodgers strike bipartisan deal on landmark data privacy bill | The Spokesman-Review". The Spokesman-Review. Archived from the original on April 11, 2024. Retrieved April 12, 2024.
  22. ^ a b Lima-Strong, Cristiano (April 7, 2024). "Lawmakers unveil sprawling plan to expand online privacy protections". The Washington Post. Archived from the original on April 7, 2024. Retrieved April 12, 2024.
  23. ^ "House Cancels American Privacy Rights Act Markup". natlawreview.com. Retrieved August 16, 2024.
  24. ^ a b c Cameron, Dell. "Surprise! The Latest 'Comprehensive' US Privacy Bill Is Doomed". Wired. ISSN 1059-1028. Archived from the original on June 29, 2024. Retrieved June 29, 2024.
  25. ^ a b Klar, Rebecca (June 27, 2024). "Data privacy bill markup canceled after House leadership opposition". The Hill. Archived from the original on June 29, 2024. Retrieved June 29, 2024.
  26. ^ "Bipartisan bill would strengthen data privacy protections". NewsNation. April 18, 2024. Archived from the original on April 20, 2024. Retrieved April 20, 2024.
  27. ^ "The American Privacy Rights Act of 2024: Section-by-Section Summary". United States Senate Committee on Commerce, Science, & Transportation. 2024. Archived from the original on April 13, 2024. Retrieved April 12, 2024.
  28. ^ Kelly, Makena. "A Breakthrough Online Privacy Proposal Hits Congress". Wired. ISSN 1059-1028. Archived from the original on April 12, 2024. Retrieved April 12, 2024.
  29. ^ a b "Revised Draft of American Privacy Rights Act Approved". natlawreview.com. Archived from the original on June 25, 2024. Retrieved June 25, 2024.
  30. ^ "House pivots on data privacy bill, removing algorithmic discrimination coverage". Nextgov.com. June 25, 2024. Archived from the original on June 26, 2024. Retrieved June 29, 2024.
  31. ^ Trujillo, Mario (April 16, 2024). "Americans Deserve More Than the Current American Privacy Rights Act". Electronic Frontier Foundation. Archived from the original on April 19, 2024. Retrieved April 20, 2024.
  32. ^ Baker, Stewart (May 15, 2024). "Congress is Preparing to Restore Quotas in College Admissions". The Volokh Conspiracy. Archived from the original on May 17, 2024. Retrieved May 17, 2024.
  33. ^ Sloane, Garett (April 19, 2024). "Ad Targeting May Be Banned--Inside the US Privacy Proposal That Could Jeopardize the Marketing Tactic". Ad Age. Archived from the original on April 20, 2024. Retrieved April 20, 2024.
  34. ^ Dubé, Jean-Pierre; Lynch, John (August 12, 2024). "A bipartisan data-privacy law could backfire on small businesses − 2 marketing professors explain why". The Conversation. Retrieved August 16, 2024.
edit
Retrieved from "https://en.wiki.x.io/w/index.php?title=American_Privacy_Rights_Act&oldid=1258806357"