"A New US Data Privacy Bill Aims to Give You More Control Over Information Collected About You – And Make Businesses Change How They Handle Data"
On July 20, 2022, the American Data and Privacy Protection Act (ADPPA) was moved out of the US House of Representatives Committee on Energy and Commerce by a vote of 53-2. The bill still needs to be passed by the full House and Senate. ADPPA includes federal preemption over some state data privacy laws, allows individuals to sue for violations, changes data privacy law enforcement significantly, and more. It has received mixed reactions from the media, academics, and businesses. However, many see the bill as a victory for data privacy in the US, providing a much-needed national standard for data practices. ADPPA would apply to "covered" entities, which include non-profits and sole proprietors who collect, process, or transfer covered data. It also regulates cellphone and Internet Service Providers (ISPs), as well as other common carriers, potentially leading to changes in federal communications regulation. It is not applicable to government entities. According to the ADPPA, "covered" data is any information or device that identifies or can be reasonably linked to a person. It also safeguards biometric data, genetic data, and geolocation data. The bill does not cover deidentified data, employee data, and publicly available information. Publicly available information includes public social media accounts with privacy settings. While studies have shown that deidentified data can be easily reidentified, the ADPPA attempts to address this by requiring covered entities to take reasonable technical, administrative, and physical measures to ensure that the information cannot be used to reidentify any individual or device at any point. The act would require as little data collection as possible. It would authorize covered entities to collect, use, or share an individual's data only when it is reasonably necessary and proportionate to a product or service requested by the person or to respond to a communication initiated by the person. It enables data collection for authentication, security incidents, the prevention of illegal activities or serious harm to individuals, and the fulfillment of legal obligations. This article continues to discuss how ADPPA would help protect data privacy.