A Pedestrian’s View of a Comprehensive Data Privacy Framework: The Case of the APRA Data Privacy Protection Act Revisited

Congress may be closer than ever to passing a comprehensive data privacy framework after key House and Senate committee leaders released a new proposal on Sunday.

The legislation would require large companies to minimize the amount of data they collect on users and allow them to correct, delete, or export their data. It would give consumers the right to opt out of targeted advertising and the transfer of their information and let them opt out of the use of an algorithm to make important life decisions for them, like those related to housing, employment, education, and insurance. The bill mandates the protection of consumers’ private information.

It’s the first major bipartisan proposal for a comprehensive privacy bill since the American Data Privacy Protection Act was introduced two years ago. The bill didn’t receive the support of the four corners of Senate Commerce and the House E&C leadership that supported it. The most significant comprehensive bipartisan digital privacy agreement was sabotaged by her failure to support that bill.

The Federal Trade Commission and individual states could enforce the law, which also includes a private right of action for individual consumers to bring lawsuits where their privacy rights are violated. If there is a significant privacy harm or harm to a child, forced arbitration is not allowed. It would mostly destroy state privacy laws with the exception of relief available under Illinois and California’s privacy laws.

In an interview with the Spokesman Review on Sunday, McMorris Rodgers claimed that the draft’s language is stronger than any active laws, seemingly as an attempt to assuage the concerns of Democrats who have long fought attempts to preempt preexisting state-level protections. APRA does allow states to pass their own privacy laws related to civil rights and consumer protections, among other exceptions.

Cantwell objected to the hurdles the earlier bill put in place for individuals to sue for alleged violations of their privacy rights, an E&C aide noted on the call with reporters, like requiring them to notify their state attorney general and the Federal Trade Commission before filing suit. The new draft does not include the requirement of a mandatory private right of action, meaning that individual consumers can still take action against companies if they believe their rights were violated.

“I think we have threaded a very important needle here,” Cantwell told the Spokesman Review. “We are preserving those standards that California and Illinois and Washington have.”

Still, it remains unclear whether APRA will receive the necessary support for approval. Committee aids said there are ongoing conversations about other lawmakers signing onto the legislation. While there is no official date for introducing the bill, Cantwell and McMorris Rodgers plan to send the draft to committees this month so they have time to read it and get feedback from their colleagues.

But it also gives companies the chance to correct the allegedly violating behavior. People who want to sue for injunctive relief or damages need to first give notice of the alleged violation, and the company would have 30 days to cure the issue. The bill does not require notice before a claim can be made for substantial privacy harm and could include physical or mental harm.

Pallone released a statement on the proposal Sunday, calling it “a very strong discussion draft,” but said there are still “some key areas where I think we can strengthen the bill, especially children’s privacy.” Pallone added that he’s “optimistic that we’ll be able to build on that record as Chair Rodgers and I work together to get comprehensive privacy legislation across the finish line.”

Cruz said in the statement that he would be carefully reviewing the bill to see if it had the same flaws as the American Data Privacy and Protection Act. However, he indicated some areas where he may take issue with the new proposal. Cruz doesn’t support a bill that gives the FTC authority to act like a referees of internet speech or imposes crushing new regulatory costs on upstart competitors.

The draft proposal comes as the House has moved forward with legislation to ban or force a sale of TikTok over security concerns and a separate bill to ban data brokers from selling US consumer data to foreign adversaries. A Commerce aide told reporters the draft bill is completely separate from the one about TikTok and there are no current plans to move them in tandem.