New Data Privacy Rights Up for Review (2024)

The American Privacy Rights Act of 2024 seeks to solve Americans’ data privacy concerns.

After years of unsuccessful attempts to regulate personal data privacy laws at the federal level, the American Privacy Rights Act of 2024 (APRA) draft was introduced last month by U.S. Senator Maria Cantwell, Chair of the Senate Committee on Commerce, Science, and Transportation, and U.S. Representative Cathy McMorris Rodgers, Chair of the House Energy and Commerce Committee for review.

The APRA would establish national, enforceable data privacy rights for Americans under a single umbrella and set standards for data security, streamlining the existing patchwork of individual state laws. Under the Act, covered entities would be required to offer transparency about how they use consumer data and give consumers the right to access and direct their own data, including opting out of targeted advertising and data transfers. Additionally, companies would only be allowed to use data for necessary purposes and would not be allowed to transfer sensitive data to third parties without express consumer consent.

“This bipartisan, bicameral draft legislation is the best opportunity we’ve had in decades to establish a national data privacy and security standard that gives people the right to control their personal information,” said Cantwell and Rodgers.

What Does the APRA Cover?

Uniform national data privacy rights for Americans under the APRA would:

• Put people in control of their personal data.
• Eliminate the patchwork of state laws by setting one national privacy standard, with some exceptions.
• Minimize the data that companies can collect, keep, and use about people, of any age, to what companies actually need to provide them products and services.
• Give Americans control over where their personal information goes, including the ability to prevent the transfer or selling of their data. The bill also allows individuals to opt out of data processing if a company changes its privacy policy.
• Provide stricter protections for sensitive data by requiring affirmative express consent before sensitive data can be transferred to a third party.
• Require companies to let people access, correct, delete, and export their data.
• Allow individuals to opt out of targeted advertising.

Enforceable Rights

If adopted, the APRA would provide individuals with a path for enforcing their rights. It gives individuals the right to sue bad actors who violate their privacy rights and recover money for damages when they’ve been harmed. Additionally, it prevents companies from enforcing mandatory arbitration in cases of substantial privacy harm.

Protected Civil Rights

The APRA enforces the civil rights of all American citizens. It:

• Stops companies from using people’s personal information to discriminate against them.
• Allows individuals to opt out of a company’s use of algorithms to make decisions about housing, employment, healthcare, credit opportunities, education, insurance, or access to places of public accommodation.
• Requires annual reviews of algorithms to ensure they do not put individuals, including youth, at risk of harm, including discrimination.

Security Obligations

The Act also mandates strong data security standards that prevent data from being hacked or stolen and requires executives to take responsibility for ensuring that their companies take all actions necessary to protect customer data. The Act ensures individuals will know when their data has been transferred to foreign adversaries and authorizes the Federal Trade Commission (FTC), states, and consumers to enforce against violations. As part of the legislation, the FTC would maintain a data broker registry. Each broker will need to keep a public website that identifies them as a data broker, where consumers can opt out from data collection.

Next Steps

Because the Act is still in discussion, next steps are not yet set. If approved in committee, the APRA would then be considered by the House of Representatives and Senate. Voting in both chambers requires a simple majority agreement for passage. Following a passing vote there, the Act must finally be signed into law by the president.

Since this legislation has substantial support on both sides of the aisle, adoption may be near. If passed, regulations would take effect 180 days after enactment.

Resources:

Senate Press Release: The American Privacy Rights Act of 2024

The American Privacy Rights Act of 2024 Section-by-Section Summary

CRS Summary of The American Privacy Rights Act