While many new privacy laws are becoming effective at a state level, the United States still hasn’t adopted an all-encompassing federal law on data privacy and protection. Then, if Bill H.R. 8152, the American Data Privacy Protection Act (ADPPA), strong of bipartisan support, were to pass, it would become the first federal privacy law after almost two decades of discussion.
In this post, we’ll go over the main definitions and requirements of the bill, to have a clearer idea of what would happen if the ADPPA were enforced.
At a glance:
- What is the American Data Privacy Protection Act (ADPPA)?
- Who does the ADPPA apply to?
- What is considered covered data under the ADPPA?
- Main principles of the American Data Privacy and Protection Act
- Consumer data rights
- Legal requirements under the ADPPA
What is the American Data Privacy Protection Act (ADPPA)?
According to the official text, the ADPPA is:
A Bill to provide consumers with foundational data privacy rights, create strong oversight mechanisms, and establish meaningful enforcement.
The ADPPA would grant all US consumers significant data privacy rights, while also establishing a monitoring system for the collection and processing of data carried out by covered entities.
As a federal law, the ADPPA would generally preempt other state-level privacy laws that are covered by its provisions, such as California’s CPRA or Virginia’s VCDPA. That means that entities doing business in the US would have to comply with the ADPPA, since most state laws would no longer apply.
Preemption of State laws
No State or political subdivision of a State may adopt, maintain, enforce, prescribe, or continue in effect any law, regulation, rule, standard, requirement, or other provision having the force and effect of law of any State, or political subdivision of a State, covered by the provisions of this Act, or a rule, regulation, or requirement promulgated under this Act.
The U.S. Federal Trade Commission would mainly be responsible for enforcing the bill. According to the draft, the FTC is required to establish a new bureau called “Bureau of Privacy”, which would take care of supervising and enforcing the bill.
Who does the ADPPA apply to?
The American Data Privacy Protection Act would apply to the so-called “covered entities”.
The draft text defines a covered entity as “any entity or person, other than an individual acting in a non-commercial context, that alone or jointly with others determines the purposes and means of collecting, processing, or transferring covered data”. This broad definition covers the vast majority of businesses.
The definition doesn’t include Federal, State, Tribal, territorial, or local government entities, or any person or entity collecting and processing data on their behalf.
What is considered personal data under the ADPPA?
The ADPPA defines “covered data” as information that – alone or in combination with other information – can lead to the identification of, or is linked or reasonably linkable to, an individual or his device. This definition also includes unique identifiers, such as IP addresses.
On the other hand, the definition of “covered data” does not include:
- de-identified data;
- employee data;
- publicly available information; or
- inferences made from multiple independent sources of publicly available information that do not reveal sensitive covered data with respect to an individual.
The American Data Privacy Protection Act also includes a specific section dedicated to “sensitive covered data”: social security and passport numbers; health information; financial account, debit card and credit card numbers; biometric and genetic information; private communications; any account or device log-in credentials, to name but a few.
Main principles of the American Data Privacy and Protection Act
Under Title I – Duty of Loyalty, the ADPPA defines its main principles:
- Data minimization: a business should limit its collection, processing and transfer of covered data only to what is reasonably necessary and proportionate to fulfill a permitted purpose or provide a specific product or service requested by the individual to whom the data belong.
- Loyalty duties: mainly include those activities that the ADPPA prohibits, namely: the processing of sensitive data, whenever not necessary to provide the individual with a service he requested, or the transfer of personal data to a third party without the individual’s consent.
- Privacy by design: entities that collect and process personal data should implement safeguards and security practices, to ensure that their activity is carried out safely and in compliance with applicable laws.
- Loyalty to individuals with respect to pricing: covered entities are required to refrain from retaliating against an individual for exercising any of the rights guaranteed by the ADPPA, including denying goods or services, charging different prices or rates, or providing a different level of quality.
Consumer data rights under the ADPPA
Consumers’ rights under Title II of the ADPPA include:
- Consumer Awareness: within 90 days from the enactment of the ADPPA, the FTC would be required to publish a description of each provision, right, obligation, and requirement of the Act in its website.
- Transparency: each covered entity shall make publicly available, in a clear, conspicuous, easy-to-read and readily accessible manner, a privacy policy that provides a detailed and accurate representation of their data collection, processing, and transfer activities.
- Individual Data Ownership and Control: individuals have the right to access, correct, delete, and portability of, their data.
- Right to Consent and Object: entities must provide individuals with a mean to, among others, give and withdraw their consent with respect to the processing or transfer of their covered data and opt-out of targeted advertising.
- Data Protections for Children and Minors: organizations are subject to additional requirements when individuals under the age of 17 are involved. For example, targeted advertising is expressly prohibited, as well as the transfer of data to third parties, if there’s no explicit consent from the covered minor or the covered minor’s parent or guardian.
- Third-party collecting entities: third-party collecting entities shall place a clear and conspicuous notice on their website and/or app, informing individuals that they are a third-party collecting entity, using the language specified by FTC regulations.
- Data Security and Protection of Covered Data: organizations must implement and maintain data security practices and procedures that protect and secure data against unauthorized access and acquisition.
Legal requirements under the ADPPA
Since the bill has not completed the legislative procedure nor been passed, there are no effective legal requirements yet. However, should the ADPPA become effective in its current text, covered entities would be subject to the following obligations:
- A privacy policy: privacy policies are expressly mentioned in the text and should at least include:
- the covered entity’s contact information
; - the details of the third parties who are receiving the data;
- what kind of data is being collected and processed and why;
- what rights the individuals have in relation to their data and how they can exercise them;
- how long the organization plans to store the data.
- the covered entity’s contact information
- A mechanism to collect consent for the processing of sensitive covered data and for individuals to withdraw it.
- A mechanism to opt-out of target advertising.
- If you’re a third-party collecting entity, a clear notice on your website and/or app informing individuals of your activity.
❓
What do I need to do?
Right now, there’s nothing you should do concerning the ADPPA: the text is still a draft and the discussion could take months. However, our team at iubenda will always monitor the situation and alert you of any changes and updates.
👉 Just make sure to sign up here, and don’t miss the latest news!
One thing you could do, though, is to check whether any of the newly effective US State Privacy Laws apply to you! If that’s the case, then you would need to comply with their requirements.
Don’t worry, it’s easier than you think!
About us
Attorney-level solutions to make your websites and apps compliant with the law across multiple countries and legislations.