While many new privacy laws are becoming effective at a state level, the United States still hasn’t adopted an all-encompassing federal law on data privacy and protection. Then, if Bill H.R. 8152, the American Data Privacy Protection Act (ADPPA), strong of bipartisan support, were to pass, it would become the first federal privacy law after almost two decades of discussion.
In this post, we’ll go over the main definitions and requirements of the bill, to have a clearer idea of what would happen if the ADPPA were enforced.
According to the official text, the ADPPA is:
A Bill to provide consumers with foundational data privacy rights, create strong oversight mechanisms, and establish meaningful enforcement.
The ADPPA would grant all US consumers significant data privacy rights, while also establishing a monitoring system for the collection and processing of data carried out by covered entities.
As a federal law, the ADPPA would generally preempt other state-level privacy laws that are covered by its provisions, such as California’s CPRA or Virginia’s VCDPA. That means that entities doing business in the US would have to comply with the ADPPA, since most state laws would no longer apply.
Preemption of State laws
No State or political subdivision of a State may adopt, maintain, enforce, prescribe, or continue in effect any law, regulation, rule, standard, requirement, or other provision having the force and effect of law of any State, or political subdivision of a State, covered by the provisions of this Act, or a rule, regulation, or requirement promulgated under this Act.
The U.S. Federal Trade Commission would mainly be responsible for enforcing the bill. According to the draft, the FTC is required to establish a new bureau called “Bureau of Privacy”, which would take care of supervising and enforcing the bill.
The American Data Privacy Protection Act would apply to the so-called “covered entities”.
The draft text defines a covered entity as “any entity or person, other than an individual acting in a non-commercial context, that alone or jointly with others determines the purposes and means of collecting, processing, or transferring covered data”. This broad definition covers the vast majority of businesses.
The definition doesn’t include Federal, State, Tribal, territorial, or local government entities, or any person or entity collecting and processing data on their behalf.
The ADPPA defines “covered data” as information that – alone or in combination with other information – can lead to the identification of, or is linked or reasonably linkable to, an individual or his device. This definition also includes unique identifiers, such as IP addresses.
On the other hand, the definition of “covered data” does not include:
The American Data Privacy Protection Act also includes a specific section dedicated to “sensitive covered data”: social security and passport numbers; health information; financial account, debit card and credit card numbers; biometric and genetic information; private communications; any account or device log-in credentials, to name but a few.
Under Title I – Duty of Loyalty, the ADPPA defines its main principles:
Consumers’ rights under Title II of the ADPPA include:
Since the bill has not completed the legislative procedure nor been passed, there are no effective legal requirements yet. However, should the ADPPA become effective in its current text, covered entities would be subject to the following obligations:
Right now, there’s nothing you should do concerning the ADPPA: the text is still a draft and the discussion could take months. However, our team at iubenda will always monitor the situation and alert you of any changes and updates.
👉 Just make sure to sign up here, and don’t miss the latest news!One thing you could do, though, is to check whether any of the newly effective US State Privacy Laws apply to you! If that’s the case, then you would need to comply with their requirements.
Attorney-level solutions to make your websites and apps compliant with the law across multiple countries and legislations.
