![](/wp-content/uploads/2022/08/082922-08-Privacy.jpg)
A bipartisan data privacy bill aims to affect the information websites, social media platforms, and all other businesses collect.
![](/wp-content/uploads/2022/08/AmyToomeyMcKenna100.jpg)
By
Visiting Professor of Law
Introduction
Data privacy in the U.S. is, in many ways, a legal void. While there are limited protections for health and financial data, the cradle of the world鈥檚 largest tech companies, like Apple, Amazon, Google, and Meta (Facebook), . This leaves U.S. citizens with minimal protections . But that may be about to change.
With rare , the moved out of the U.S. House of Representatives Committee on Energy and Commerce on July 20, 2022. The bill still needs to pass the full House and the Senate, and . Given the Biden administration鈥檚 , White House support is likely if a version of the bill passes.
As a legal scholar and attorney who , I鈥檝e been closely following the act, known as ADPPA. If passed, it will fundamentally alter U.S. data privacy law.
ADPPA fills the data privacy void, builds in federal preemption over some state data privacy laws, allows individuals to file suit over violations and substantially changes data privacy law enforcement. Like all big changes, ADPPA is getting mixed reviews from , and . But many see the bill as a triumph for U.S. data privacy that provides a needed national standard for data practices.
Who and What Will ADPPA Regulate?
ADPPA would apply to 鈥渃overed鈥 entities, meaning any entity collecting, processing or transferring covered data, including nonprofits and sole proprietors. It also regulates cellphone and internet providers and other , with . It does not apply to government entities.
ADPPA defines 鈥渃overed鈥 data as any information or device that identifies or can be reasonably linked to a person. It also protects biometric data, genetic data and geolocation information.
![](/wp-content/uploads/2022/08/082922-09-Privacy.jpg)
The bill excludes three big data categories: deidentified data, employee data and publicly available information. That last category includes social media accounts with privacy settings open to public viewing. While has repeatedly shown , the ADPPA attempts to address that by requiring covered entities to take 鈥渞easonable technical, administrative, and physical measures to ensure that the information cannot, at any point, be used to re-identify any individual or device.鈥
How ADPPA Protects Your Data
The act would require data collection to be as minimal as possible. The bill allows covered entities to collect, use or share an individual鈥檚 data only when reasonably necessary and proportionate to a product or service the person requests or to respond to a communication the person initiates. It allows collection for authentication, security incidents, prevention of illegal activities or serious harm to persons, and compliance with legal obligations.
People would gain rights to access and have some control over their data. ADPPA gives users the right to correct inaccuracies and potentially delete their data held by covered entities.
The bill permits data collection as part of research for public good. It allows data collection for peer-reviewed research or research done in the public interest 鈥 for example, testing whether a website is unlawfully discriminating. This is important for researchers who might otherwise run afoul of site terms or hacking laws.
The ADPPA also has a provision that 鈥 those annoying 鈥淚 Agree鈥 boxes that force people to accept a jumble of legal terms. When you click one of those boxes, you contractually waive your privacy rights as a condition to simply use a service, visit a website or buy a product. The bill will prevent covered entities from using contract law to get around the bill鈥檚 protections.
Looking to Federal Electronic Surveillance for Guidance
The U.S.鈥檚 can provide federal law makers guidance in finalizing ADPPA. Like the ADPPA, the 1986 ECPA legislation involved a massive overhaul of U.S. electronic privacy law to address adverse effects to individual privacy and civil liberties posed by advancing surveillance and communication technologies. Once again, advances in surveillance and data technologies, such as artificial intelligence, are significantly affecting citizens鈥 rights.
ECPA, still in effect today, provides a baseline national standard for electronic surveillance protections. ECPA protects communications from interception unless one party to the communication consents. But ECPA does not preempt states from passing more protective laws, so states can choose to provide greater privacy rights. The end result: Roughly a quarter of U.S. states require consent of all parties to intercept a communication, thus providing their citizens increased privacy rights.
ECPA鈥檚 federal/state balance has worked for decades now, and ECPA has not overwhelmed the courts or destroyed commerce.
National Preemption
As drafted, ADPPA preempts some state data privacy legislation. This affects , although it does not preempt the or state laws specifically regulating facial recognition technology. The preemption provisions, however, are in flux as members of the House continue to negotiate the bill.
ADPPA鈥檚 national standards provide uniform compliance requirements, serving economic efficiency; but its preemption of most state laws has , and .
If preemption stands, any final version of the ADPPA will be the law of the land, limiting states from more firmly protecting their citizens鈥 data privacy.
Private Right of Action and Enforcement
ADDPA provides for a , allowing people to sue covered entities who violate their rights under ADPPA. That gives the bill鈥檚 enforcement mechanisms a big boost, although it has significant restrictions.
The and the tech industry oppose a private right of action, preferring ADPPA enforcement be restricted to the Federal Trade Commission. But the FTC has far less staff and far fewer resources than U.S. trial attorneys do.
ECPA, for comparison, has a private right of action. It has not overwhelmed courts or businesses, and entities likely comply with ECPA to avoid civil litigation. Plus, courts have honed ECPA鈥檚 terms, providing clear precedent and understandable compliance guidelines.
How Big Are the Changes?
The changes to U.S. data privacy law are big, but ADPPA affords much-needed security and data protections to U.S. citizens, and I believe that it is workable with tweaks.
Given how the internet works, data routinely flows across international borders, so many U.S. companies have already built compliance with other nations鈥 laws into their systems. This includes the 鈥 a law similar to the ADPPA. Facebook, for example, provides E.U. citizens with GDPR鈥檚 protections, but it does not give U.S. citizens those protections, because it is not required to do so.
Congress has done little with data privacy, but ADPPA is poised to change that.
Originally by , 08.23.2022, under the terms of a license.