US legislators propose American Privacy Rights Act - and it looks quite good
(2024/04/09)
- Reference: 1712626334
- News link: https://www.theregister.co.uk/2024/04/09/us_federal_privacy_law_apra/
- Source link:
Americans may soon live under a federal privacy law – a mere two decades after the US Federal Trade Commission urged Congress to regulate online data collection.
On Monday, US representative Cathy McMorris Rodgers (R-WA) and US senator Maria Cantwell (D-WA) announced the [1]American Privacy Rights Act [PDF], which aims to provide a comprehensive set of rules governing how citizens' data is used.
"This bipartisan, bicameral draft legislation is the best opportunity we’ve had in decades to establish a national data privacy and security standard that gives people the right to control their personal information," declared Rodgers and Cantwell, in a joint [2]statement , claiming the bill will give US citizens control over their data and who can sell it.
[3]
The largely unrestrained sale of online data has made a mockery of the concept of privacy – a term that has come to mean "data usage" among tech firms. In May 2000, the Federal Trade Commission (FTC) asked Congress to pass a data privacy law, but federal legislation did not flow. At the state level, the Illinois Biometric Information Privacy Act passed in 2008 and has been used [4]against Facebook and [5]others .
[6]
[7]
The FTC again asked Congress to pass a federal privacy law [8]in 2014 .
With respect to data brokers that sell marketing products, the Commission recommends that Congress consider legislation requiring data brokers to provide consumers access to their data – including sensitive data held about them – at a reasonable level of detail, and the ability to opt out of having it shared for marketing purposes.
Again, US lawmakers didn't respond to the challenge and, as a result, online privacy suffered. There was, however, quite a bit of lobbying to prevent privacy rules from being adopted. And of course then came the [9]Facebook/Cambridge Analytica scandal to illustrate what can happen without privacy protections.
But in 2018, Europe enacted its General Data Protection Regulation. Two years later, California passed the California Consumer Privacy Act (CCPA), followed by Virginia and Colorado.
Today, there are 15 state privacy laws – 14 of which, according to [10]Maryland PIRG Foundation and the Electronic Privacy Information Center [PDF], "follow a model that was initially drafted by industry giants such as Amazon."
[11]
In 2022, the American Data Privacy and Protection Act (ADPPA) was proposed. Though popular, it was opposed by some lawmakers who were concerned it would preempt stronger protections in states like California.
[12]US insurers use drone photos to deny home insurance policies
[13]Head of Israeli cyber spy unit exposed ... by his own privacy mistake
[14]Academics probe Apple's privacy settings and get lost and confused
[15]Google will delete data collected from 'private' browsing
Fast forward to last month, and we find Congress [16]voting unanimously on a bill to ban data brokers from selling US citizens' data to foreign adversaries – evidently, some don't like the idea of [17]Putin buying the personal info of US soldiers. And thanks to the overturning of Roe v. Wade by the US Supreme Court in 2022, the privacy risk posed by location and health data has taken on new urgency.
After decades of relying on narrow, industry-specific rules like the Video Privacy Protection Act of 1998, the Health Insurance Portability and Accountability Act (HIPAA) of 1996, and the Children's Online Privacy Protection Act of 1998, the Land of the Free might finally get a meaningful national data protection law.
So what's inside the box?
The American Privacy Rights Act (APRA) would preempt state privacy rules – with exceptions for consumer protection laws, civil rights laws, laws that address the privacy rights of employees and students, laws data breach notification laws, contract, tort, and criminal laws, public safety laws, and public records laws, among other categories.
It would require impact assessments for large data brokers using a covered algorithm that poses a substantial risk of harm, when applied to: minors; housing, education, employment, health care, insurance, or credit opportunities; public accommodations based on protected characteristics (e.g. race); or disparate impacts based on such characteristics or on political party affiliation.
Large organizations (with more than $250 million in revenue, among other criteria) would be required to have a privacy or data security officer. Small businesses with less than $40 million in revenue are exempt from the APRA.
The legislation gives individuals the right to sue for privacy harms, and disallows mandatory arbitration in claims involving minors or a substantial privacy harm – set at $10,000 – or specific physical or mental harms.
[18]
Generally, the bill aims to give people control over their personal data by allowing them to prevent the sale or transfer of their information and to opt out of data processing if a privacy policy changes. It also allows people to opt out of targeted advertising, and requires that businesses that collect data allow people to access, correct, delete, and export their data.
It remains to be seen if the House and the Senate will approve the bill. In 2023, the House passed [19]just 27 pieces of legislation – the lowest number in a century. But perhaps there's enough concern about privacy in this "Do Nothing Congress" that Republican and Democratic lawmakers can manage to get themselves into gear.
State legislators in Maryland have already taken action. On Saturday, the Maryland General Assembly passed the [20]Maryland Online Privacy Protection Act of 2024 (HB 567/SB 541), which awaits approval from governor Wes Moore – a Democrat who has yet to signal his stance on the legislation.
RJ Cross, PIRG's Don't Sell My Data campaign director, endorsed the Maryland bill. "Tech lobbyists have successfully gutted legislation in states across the country, but not in Maryland," Cross opined. "Maryland lawmakers have bucked the trend by standing up to the tech industry in order to protect Maryland consumers." ®
Get our [21]Tech Resources
[1] https://www.commerce.senate.gov/services/files/3F5EEA76-5B18-4B40-ABD9-F2F681AA965F
[2] https://energycommerce.house.gov/posts/committee-chairs-rodgers-cantwell-unveil-historic-draft-comprehensive-data-privacy-legislation
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZhS9XegU2Hv5oW@iE3Ey0AAAAI4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://www.theregister.com/2015/09/07/facebook_biometrics_class_action_suit/
[5] https://www.theregister.com/2020/01/26/ai_roundup_240120/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZhS9XegU2Hv5oW@iE3Ey0AAAAI4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZhS9XegU2Hv5oW@iE3Ey0AAAAI4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2014/05/27/ftc_calls_for_congress_to_crack_down_on_consumer_data_harvesting/
[9] https://about.fb.com/news/2018/03/suspending-cambridge-analytica/
[10] https://pirg.org/wp-content/uploads/sites/84/2024/02/The-State-of-Privacy-MD-PIRG-and-EPIC-Feb.-2024-1.pdf
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZhS9XegU2Hv5oW@iE3Ey0AAAAI4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://www.theregister.com/2024/04/08/us_insurers_drones/
[13] https://www.theregister.com/2024/04/08/infosec_news_roundup/
[14] https://www.theregister.com/2024/04/05/apple_apps_privacy_study/
[15] https://www.theregister.com/2024/04/01/google_will_delete_data_incognito/
[16] https://www.theregister.com/2024/03/21/congress_votes_unanimously_to_ban/
[17] https://www.theregister.com/2023/11/07/data_brokers_military_data/
[18] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZhS9XegU2Hv5oW@iE3Ey0AAAAI4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[19] https://www.thenation.com/article/politics/do-nothing-congress/
[20] https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/sb0541?ys=2024RS
[21] https://whitepapers.theregister.com/
On Monday, US representative Cathy McMorris Rodgers (R-WA) and US senator Maria Cantwell (D-WA) announced the [1]American Privacy Rights Act [PDF], which aims to provide a comprehensive set of rules governing how citizens' data is used.
"This bipartisan, bicameral draft legislation is the best opportunity we’ve had in decades to establish a national data privacy and security standard that gives people the right to control their personal information," declared Rodgers and Cantwell, in a joint [2]statement , claiming the bill will give US citizens control over their data and who can sell it.
[3]
The largely unrestrained sale of online data has made a mockery of the concept of privacy – a term that has come to mean "data usage" among tech firms. In May 2000, the Federal Trade Commission (FTC) asked Congress to pass a data privacy law, but federal legislation did not flow. At the state level, the Illinois Biometric Information Privacy Act passed in 2008 and has been used [4]against Facebook and [5]others .
[6]
[7]
The FTC again asked Congress to pass a federal privacy law [8]in 2014 .
With respect to data brokers that sell marketing products, the Commission recommends that Congress consider legislation requiring data brokers to provide consumers access to their data – including sensitive data held about them – at a reasonable level of detail, and the ability to opt out of having it shared for marketing purposes.
Again, US lawmakers didn't respond to the challenge and, as a result, online privacy suffered. There was, however, quite a bit of lobbying to prevent privacy rules from being adopted. And of course then came the [9]Facebook/Cambridge Analytica scandal to illustrate what can happen without privacy protections.
But in 2018, Europe enacted its General Data Protection Regulation. Two years later, California passed the California Consumer Privacy Act (CCPA), followed by Virginia and Colorado.
Today, there are 15 state privacy laws – 14 of which, according to [10]Maryland PIRG Foundation and the Electronic Privacy Information Center [PDF], "follow a model that was initially drafted by industry giants such as Amazon."
[11]
In 2022, the American Data Privacy and Protection Act (ADPPA) was proposed. Though popular, it was opposed by some lawmakers who were concerned it would preempt stronger protections in states like California.
[12]US insurers use drone photos to deny home insurance policies
[13]Head of Israeli cyber spy unit exposed ... by his own privacy mistake
[14]Academics probe Apple's privacy settings and get lost and confused
[15]Google will delete data collected from 'private' browsing
Fast forward to last month, and we find Congress [16]voting unanimously on a bill to ban data brokers from selling US citizens' data to foreign adversaries – evidently, some don't like the idea of [17]Putin buying the personal info of US soldiers. And thanks to the overturning of Roe v. Wade by the US Supreme Court in 2022, the privacy risk posed by location and health data has taken on new urgency.
After decades of relying on narrow, industry-specific rules like the Video Privacy Protection Act of 1998, the Health Insurance Portability and Accountability Act (HIPAA) of 1996, and the Children's Online Privacy Protection Act of 1998, the Land of the Free might finally get a meaningful national data protection law.
So what's inside the box?
The American Privacy Rights Act (APRA) would preempt state privacy rules – with exceptions for consumer protection laws, civil rights laws, laws that address the privacy rights of employees and students, laws data breach notification laws, contract, tort, and criminal laws, public safety laws, and public records laws, among other categories.
It would require impact assessments for large data brokers using a covered algorithm that poses a substantial risk of harm, when applied to: minors; housing, education, employment, health care, insurance, or credit opportunities; public accommodations based on protected characteristics (e.g. race); or disparate impacts based on such characteristics or on political party affiliation.
Large organizations (with more than $250 million in revenue, among other criteria) would be required to have a privacy or data security officer. Small businesses with less than $40 million in revenue are exempt from the APRA.
The legislation gives individuals the right to sue for privacy harms, and disallows mandatory arbitration in claims involving minors or a substantial privacy harm – set at $10,000 – or specific physical or mental harms.
[18]
Generally, the bill aims to give people control over their personal data by allowing them to prevent the sale or transfer of their information and to opt out of data processing if a privacy policy changes. It also allows people to opt out of targeted advertising, and requires that businesses that collect data allow people to access, correct, delete, and export their data.
It remains to be seen if the House and the Senate will approve the bill. In 2023, the House passed [19]just 27 pieces of legislation – the lowest number in a century. But perhaps there's enough concern about privacy in this "Do Nothing Congress" that Republican and Democratic lawmakers can manage to get themselves into gear.
State legislators in Maryland have already taken action. On Saturday, the Maryland General Assembly passed the [20]Maryland Online Privacy Protection Act of 2024 (HB 567/SB 541), which awaits approval from governor Wes Moore – a Democrat who has yet to signal his stance on the legislation.
RJ Cross, PIRG's Don't Sell My Data campaign director, endorsed the Maryland bill. "Tech lobbyists have successfully gutted legislation in states across the country, but not in Maryland," Cross opined. "Maryland lawmakers have bucked the trend by standing up to the tech industry in order to protect Maryland consumers." ®
Get our [21]Tech Resources
[1] https://www.commerce.senate.gov/services/files/3F5EEA76-5B18-4B40-ABD9-F2F681AA965F
[2] https://energycommerce.house.gov/posts/committee-chairs-rodgers-cantwell-unveil-historic-draft-comprehensive-data-privacy-legislation
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZhS9XegU2Hv5oW@iE3Ey0AAAAI4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://www.theregister.com/2015/09/07/facebook_biometrics_class_action_suit/
[5] https://www.theregister.com/2020/01/26/ai_roundup_240120/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZhS9XegU2Hv5oW@iE3Ey0AAAAI4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZhS9XegU2Hv5oW@iE3Ey0AAAAI4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2014/05/27/ftc_calls_for_congress_to_crack_down_on_consumer_data_harvesting/
[9] https://about.fb.com/news/2018/03/suspending-cambridge-analytica/
[10] https://pirg.org/wp-content/uploads/sites/84/2024/02/The-State-of-Privacy-MD-PIRG-and-EPIC-Feb.-2024-1.pdf
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZhS9XegU2Hv5oW@iE3Ey0AAAAI4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://www.theregister.com/2024/04/08/us_insurers_drones/
[13] https://www.theregister.com/2024/04/08/infosec_news_roundup/
[14] https://www.theregister.com/2024/04/05/apple_apps_privacy_study/
[15] https://www.theregister.com/2024/04/01/google_will_delete_data_incognito/
[16] https://www.theregister.com/2024/03/21/congress_votes_unanimously_to_ban/
[17] https://www.theregister.com/2023/11/07/data_brokers_military_data/
[18] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZhS9XegU2Hv5oW@iE3Ey0AAAAI4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[19] https://www.thenation.com/article/politics/do-nothing-congress/
[20] https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/sb0541?ys=2024RS
[21] https://whitepapers.theregister.com/
Just wait
aerogems
I hate to be the pessimist, but just wait until the lobbyists are done with it and see how little it likely resembles the original bill. It'll probably be full of loopholes and exceptions so large, you could sail the entire US Navy fleet through the smallest of them. And even assuming, by some weird cosmic alignment that only happens every couple billion years, it passes exactly as it is now and is signed into law... it'll be immediately challenged in court by some data broker trade group seeking to overturn it, and they'll go judge shopping, somewhere in Texas no doubt, so they can be all but guaranteed it'll land on the docket of some anti-government federal judge who doesn't see any irony in being a federal employee.
Re: Just wait
Throatwarbler Mangrove
Maria Cantwell is basically the senator from Microsoft, so one imagines that lobbyists from Amazon and Microsoft have already weighed in. They probably see a bigger risk and cost in having to deal with 50 disparate privacy laws and would prefer to have a consistent federal law instead. I don't doubt that the lawyers will also do battle against the federal law and try to use it as leverage to override stronger state-level protections. I also doubt that the Freedom Caucus will allow the bill to be brought to the House floor because they are, at this point, unabashed in their hatred for America.
Re: Just wait
Yorick Hunt
"... the lawyers will also do battle against the federal law and try to use it as leverage to override stronger state-level protections"
And there lies the crux of the "new" law - to override and subvert existing, in some cases even functional, laws at state level.
Sounds like...
FF22
an American GDPR, just with inches and ounces instead of meters and gramms
Re: Sounds like...
aerogems
I got news for ya! We won the war!
Maybe
But I have little hope that the current House of Dysfunction can accomplish anything good.