Yves here. While more data privacy is generally a good thing, as a tiny publisher, I am concerned that, whether by accident or design, this privacy bill, if implemented, will impose costs on small fry that wind up being high relative to their revenues.
By Anne Toomey McKenna, Visiting Professor of Law, University of Richmond. Originally published at The Conversation
Data privacy in the U.S. is, in many ways, a legal void. While there are limited protections for health and financial data, the cradle of the world’s largest tech companies, like Apple, Amazon, Google, and Meta (Facebook), lacks any comprehensive federal data privacy law. This leaves U.S. citizens with minimal data privacy protections compared with citizens of other nations. But that may be about to change.
With rare bipartisan support, the American Data and Privacy Protection Act moved out of the U.S. House of Representatives Committee on Energy and Commerce by a vote of 53-2 on July 20, 2022. The bill still needs to pass the full House and the Senate, and negotiations are ongoing. Given the Biden administration’s responsible data practices strategy, White House support is likely if a version of the bill passes.
As a legal scholar and attorney who studies and practices technology and data privacy law, I’ve been closely following the act, known as ADPPA. If passed, it will fundamentally alter U.S. data privacy law.
ADPPA fills the data privacy void, builds in federal preemption over some state data privacy laws, allows individuals to file suit over violations and substantially changes data privacy law enforcement. Like all big changes, ADPPA is getting mixed reviews from media, scholars and businesses. But many see the bill as a triumph for U.S. data privacy that provides a needed national standard for data practices.
Who and What Will ADPPA Regulate?
ADPPA would apply to “covered” entities, meaning any entity collecting, processing or transferring covered data, including nonprofits and sole proprietors. It also regulates cellphone and internet providers and other common carriers, with potentially concerning changes to federal communications regulation. It does not apply to government entities.
ADPPA defines “covered” data as any information or device that identifies or can be reasonably linked to a person. It also protects biometric data, genetic data and geolocation information.
The bill excludes three big data categories: deidentified data, employee data and publicly available information. That last category includes social media accounts with privacy settings open to public viewing. While research has repeatedly shown deidentified data can be easily reidentified, the ADPPA attempts to address that by requiring covered entities to take “reasonable technical, administrative, and physical measures to ensure that the information cannot, at any point, be used to re-identify any individual or device.”
How ADPPA Protects Your Data
The act would require data collection to be as minimal as possible. The bill allows covered entities to collect, use or share an individual’s data only when reasonably necessary and proportionate to a product or service the person requests or to respond to a communication the person initiates. It allows collection for authentication, security incidents, prevention of illegal activities or serious harm to persons, and compliance with legal obligations.
People would gain rights to access and have some control over their data. ADPPA gives users the right to correct inaccuracies and potentially delete their data held by covered entities.
The bill permits data collection as part of research for public good. It allows data collection for peer-reviewed research or research done in the public interest – for example, testing whether a website is unlawfully discriminating. This is important for researchers who might otherwise run afoul of site terms or hacking laws.
The ADPPA also has a provision that tackles the service-conditioned-on-consent problem – those annoying “I Agree” boxes that force people to accept a jumble of legal terms. When you click one of those boxes, you contractually waive your privacy rights as a condition to simply use a service, visit a website or buy a product. The bill will prevent covered entities from using contract law to get around the bill’s protections.
Looking to Federal Electronic Surveillance Law for Guidance
The U.S.’s Electronic Communications Privacy Act can provide federal law makers guidance in finalizing ADPPA. Like the ADPPA, the 1986 ECPA legislation involved a massive overhaul of U.S. electronic privacy law to address adverse effects to individual privacy and civil liberties posed by advancing surveillance and communication technologies. Once again, advances in surveillance and data technologies, such as artificial intelligence, are significantly affecting citizens’ rights.
ECPA, still in effect today, provides a baseline national standard for electronic surveillance protections. ECPA protects communications from interception unless one party to the communication consents. But ECPA does not preempt states from passing more protective laws, so states can choose to provide greater privacy rights. The end result: Roughly a quarter of U.S. states require consent of all parties to intercept a communication, thus providing their citizens increased privacy rights.
ECPA’s federal/state balance has worked for decades now, and ECPA has not overwhelmed the courts or destroyed commerce.
National Preemption
As drafted, ADPPA preempts some state data privacy legislation. This affects California’s Consumer Privacy Act, although it does not preempt the Illinois Biometric Information Privacy Act or state laws specifically regulating facial recognition technology. The preemption provisions, however, are in flux as members of the House continue to negotiate the bill.
ADPPA’s national standards provide uniform compliance requirements, serving economic efficiency; but its preemption of most state laws has some scholars concerned, and California opposes its passage.
If preemption stands, any final version of the ADPPA will be the law of the land, limiting states from more firmly protecting their citizens’ data privacy.
Private right of action and enforcement
ADDPA provides for a private right of action, allowing people to sue covered entities who violate their rights under ADPPA. That gives the bill’s enforcement mechanisms a big boost, although it has significant restrictions.
The U.S. Chamber of Commerce and the tech industry oppose a private right of action, preferring ADPPA enforcement be restricted to the Federal Trade Commission. But the FTC has far less staff and far fewer resources than U.S. trial attorneys do.
ECPA, for comparison, has a private right of action. It has not overwhelmed courts or businesses, and entities likely comply with ECPA to avoid civil litigation. Plus, courts have honed ECPA’s terms, providing clear precedent and understandable compliance guidelines.
How Big Are the Changes?
The changes to U.S. data privacy law are big, but ADPPA affords much-needed security and data protections to U.S. citizens, and I believe that it is workable with tweaks.
Given how the internet works, data routinely flows across international borders, so many U.S. companies have already built compliance with other nations’ laws into their systems. This includes the E.U.’s General Data Protection Regulation – a law similar to the ADPPA. Facebook, for example, provides E.U. citizens with GDPR’s protections, but it does not give U.S. citizens those protections, because it is not required to do so.
Congress has done little with data privacy, but ADPPA is poised to change that.
12 comments
Comments are closed.
I appreciate the effort to do something, but I question how effective this bill will be in practice. How many covered entities are there? Thousands? Do I have to go to each covered entities website, create an account, and answer a series of questions about what they are allowed to collect and not? How about data they might already have? Am I going to have a bunch of pop-ups on every website I visit asking me about this stuff?
Why can’t the system be opt-in from a single central database?
Color me skeptical with a committee vote of 53-2 and the tech industry still lobbying (ie drafting) the final bill. This bill will get Manchin’d and Sinema’d eventually and I would be shocked if the final version has the service conditioned consent and private right of action provisions in it. If they are, they will be so watered down as to be ineffective. I can see forced mediation / arbitration in our futures at best.
What you can count on is a fleet of privacy consultants being hired by corporations that will now have to modify every single one of their vendor and customer contracts with new privacy language. Been there, done that. It will take years and cost a fortune. And that is the tip of the iceberg. For a non-GDPR online product entity to comply with GDPR can take years of development and significant internal change. This may not be applicable to everyone, but it is most definitely the case where I am at currently.
I am all for strict, if not draconian, data privacy laws, but the US Congress is completely incapable of accomplishing anything to help the average citizen. This will be a boondoggle for the ‘donors’.
Do you mean, this will be a bonanza for the ‘donors’ ?
Donors, and their friends in the offshore data piracy markets. Data privacy is only one aspect and has to be stored somewhere after being transmitted from somewhere. Each step in that process has its own vulnerabilities.
You remain the product. Don’t forget that.
Hi Yves,
Although I am a bit rusty on legal matters related with privacy, I do have some 7 years under the belt working in privacy north of the border.
After the law comes into effect, I might be able to help, in a volunteer capacity.
“The bill permits data collection as part of research for public good.”
But these people have no ideological concept of “public good.”
It should only permit asking people to take part in research. And each research project that they want to collect data for needs to be specifically defined each time they want to collect. Not that generic “third party general research” mess.
They talk real pretty. Let’s see what happens.
When corporations suddenly become amenable to federal regulation it usually means they are frightened of state regulations- like the law in California. And by a 53 to 2 vote. We need a pointer to the speeches by the 2. If there are any bored lawyers reading this, here is the surprisingly short text. Give us your comments: https://www.congress.gov/bill/117th-congress/house-bill/8152/text .
The usual “Wait til’ the regs are published” also applies. The article says:
“The bill excludes three big data categories: deidentified data, employee data and publicly available information. That last category includes social media accounts with privacy settings open to public viewing. While research has repeatedly shown deidentified data can be easily reidentified, the ADPPA attempts to address that by requiring covered entities to take “reasonable technical, administrative, and physical measures to ensure that the information cannot, at any point, be used to re-identify any individual or device.”
“Reasonable” is always large enough to drive a truck bomb through. The only thing that works is a strict, False-Claims-style obligation or a liquidated damages provision which says in essence “You say you took precautions? Great. If they fail you pay X dollars for each information breach.” And deidentified. The rule should be if it is used to identify it wasn’t deidentified… and you pay. This is called strict liability.
Call it the “Unreasonable Man” standard. And count me as an unreasonable man.
Thanks Dave. I’m a bored lawyer, so I’ll take a gander. You’re “‘Reasonable’ is always large enough to drive a truck bomb through” made me laugh out loud. Man, (reasonable or not) that is the honest truth. My experience with the California law is that it is quite unworkable. The hoops one must jump through are just flat onerous, and I’ve found it does next to nothing, in fact, you must fork over a load of information. I’m not certain what the answers are. Make them utilities? But look at the chicanery in that lot.
Including things like 200 million bucks as a form of retroactive impunity does note bode well.
I wonder what and how much the big giveaways are?
New US Privacy Law May Give Telecoms Free Pass on $200 Million Fines
This sounds like a Mack truck driving through more holes than found in a block of Lorraine cheese.
How ADPPA Protects Your Data
And what is – Prevention of illegal activities? Sounds like everyone should track and hold onto everything forever because you know someone somewhere is always about to commit a crime.
Which means save and sell forever.
I see this as a reaction to the Schrems II ruling of the European Supreme Court of Justice.
In it, the Court voided Privacy Shield, the agreement that underpinned much of the EU-US data transfers. While legal work arounds were quickly implemented, the general implication was that as long as US doesn’t respect privacy from the US government, these work arounds might very well be temporary. While most of IT Europe adopted a wait and see approach, some reasoned that since we will not be able to use US cloud services, we better use this time to get out or at least make sure that any new cloud services are placed in Europe.
So the real reason for the legislation and its broad support is probably risk of losing markets for Google, Microsoft and Amazon, as well as smaller companies. Which would in turn harm the US surveilliance apparatus when the data of the world doesn’t flow to US servers.
However, the basic conflict between GDPR demands for privacy and the US surveilliance apparatus need to catch it all will remain. I would guess Max Schrems will go over the US legislation with a fine comb.
There’s an election coming in a few months. Perfect time to play to the masses on the campaign trail and pump the lobbyists for donations in the back rooms.