The American Privacy Rights Act (APRA)

What is APRA? The American Privacy Rights Act?

The American Privacy Rights Act (APRA) is a major bipartisan, bicameral bill introduced in Congress on April 7th. It was led by House Energy and Commerce Chair Cathy McMorris Rodgers (R-WA) and Senate Commerce, Science, and Transportation Chair Maria Cantwell (D-WA). The APRA is designed to:

• Act as a comprehensive federal data privacy law, overriding most state-specific privacy regulations.
• Provide privacy protections and rights for all U.S. citizens, regardless of their state, industry, or demographic group.
• Implement strong enforcement measures to ensure compliance, including oversight by the Federal Trade Commission (FTC), state attorneys general, and notably, granting individuals the ability to take legal action directly against violators.

Key Elements of the The American Privacy Rights Act (APRA)

1. Privacy Rights for Individuals

The APRA grants individuals the right to access, correct, delete, and export their personal data. It also gives them the ability to opt-out of data processing activities such as targeted advertising and the use of algorithms.

2. Obligations for Entities

Businesses and organizations that collect, process, or transfer personal data must adhere to strict data minimization principles, transparency requirements, and data security standards. The APRA also imposes additional obligations on large data holders and data brokers, including the need to conduct privacy impact assessments and provide options for individuals to opt out of data collection.

3. Consent Requirements

For sensitive data, such as biometric or genetic information, the APRA mandates that entities obtain affirmative, express consent from individuals before collecting, processing, or transferring such data. This ensures that individuals have greater control over their most sensitive personal information.

4. Enforcement Mechanisms

The APRA empowers the Federal Trade Commission (FTC) to enforce the law, with violations subject to civil penalties. State attorneys general are also authorized to bring civil actions on behalf of their residents. Notably, the APRA includes a private right of action, allowing individuals to sue for certain violations, such as unauthorized use of their sensitive data.

5. Preemption of State Laws

The APRA would override most state privacy laws, establishing a uniform set of privacy protections nationwide. However, certain state laws related to consumer protection, employee privacy, and health information may be exempt from preemption.

Consent Under APRA

Under the APRA, consent plays a critical role in protecting individuals' privacy. Entities must obtain clear and affirmative consent from individuals before processing sensitive personal data. This requirement is designed to ensure that individuals are fully aware of how their data will be used and can make informed decisions about whether to allow such processing.

Additionally, the APRA requires that individuals be given the option to opt out of certain data processing activities, such as the use of their data for targeted advertising or algorithmic decision-making. This empowers individuals to exercise greater control over their personal information and how it is used by businesses and organizations.

The American Privacy Rights Act (APRA) Timeline

1. April 7, 2024: Introduction of the APRA

The American Privacy Rights Act (APRA) was introduced by House Energy and Commerce Chair Cathy McMorris Rodgers (R-WA) and Senate Commerce, Science, and Transportation Chair Maria Cantwell (D-WA). The bill was unveiled as a bipartisan and bicameral effort to establish a comprehensive federal framework for data privacy in the United States.

2. May 23, 2024: House Energy & Commerce Committee Markup

The House Energy & Commerce Committee, particularly the Innovation, Data, and Commerce Subcommittee, reviewed an updated version of the APRA. This version included new provisions such as Title II, which amends the Children’s Online Privacy Protection Act (COPPA) and introduces new protections for minors.

3. May 31, 2024: Public Discussion and Further Updates

The Congressional Research Service (CRS) released an updated legal sidebar summarizing the APRA and highlighting key changes from the original draft. This update included comparisons with other privacy bills, stakeholder reactions, and potential legal challenges.

4. Future Developments:

• Legislative process: APRA will continue the legislative process, including debate, possible amendments and votes in the House of Representatives and Senate. If the bill is passed by both houses, it will be sent to the President for signature.
• Implementation date: The specific implementation date will be determined by the final version of the bill and may be set some time after the bill is passed to allow entities time to comply with the new regulations.

APRA applies to The following Businesses

Covered Entities:

The APRA applies to most businesses, organizations, and nonprofits, defined as "covered entities." These are entities that, either alone or in collaboration with others, determine the purposes and means of collecting, processing, retaining, or transferring personal data.

Large Data Holders:

Entities with significant data operations, particularly those with annual gross revenues exceeding $250 million and that meet certain data thresholds, are subject to additional obligations under the APRA. These large data holders must conduct algorithm impact assessments, privacy impact assessments, and make annual compliance certifications to the FTC.

Data Brokers:

The APRA also applies to entities whose primary revenue comes from processing or transferring personal data that they did not directly collect from individuals. These data brokers are required to register with the FTC and comply with specific data management and transparency requirements.

Exemptions:

Certain small businesses are exempt from the definition of "covered entities" under the APRA, which means they are not subject to the same regulations as larger organizations. However, specific criteria for these exemptions would be outlined in the final legislation.

Individuals and Consumers:

While the APRA imposes obligations on entities, it grants rights to individuals and consumers. These rights include accessing, correcting, deleting, and exporting their personal data, as well as opting out of certain types of data processing, such as targeted advertising.

APRA's key requirements

APRA Exemptions

Unlike many state-level privacy laws, the APRA does not extend to small businesses, which are defined as entities that:

• Have annual revenues of $40 million or less,
• Collect, process, retain, or transfer data of 200,000 or fewer individuals, and
• Do not generate revenue from the sale of personal data to third parties, such as data brokers.

Additionally, the APRA excludes certain organizations and entities, such as government bodies, contractors working on behalf of governments, the National Center for Missing and Exploited Children (NCMEC), and nonprofit organizations dedicated to combating fraud.

Entities that are already compliant with specific federal regulations, such as the Gramm-Leach-Bliley Act or HIPAA, are considered to be in compliance with the APRA. Moreover, the Act is designed to apply only to data that can be reasonably linked to an individual, thereby excluding de-identified data, employee data, publicly available information, and similar categories.

Primary APRA Requirements

Organizations subject to the APRA will find that its core requirements align with those found in most data privacy laws, though there are some unique elements worth noting.

Data Subject Rights

The APRA grants a suite of rights to individuals, similar to other U.S. privacy laws, including:

• The right to know what personal data has been collected,
• The right to access their data,
• The right to correct inaccuracies,
• The right to delete their data,
• The right to receive their data in a portable format, and
• The right to opt out of targeted advertising and profiling.

Large Data Holders

One of the distinct features of the APRA is the classification of "Large Data Holders," defined as entities that:

• Have annual revenues of $250 million or more,
• Handle the data of more than 5 million individuals (or comparable thresholds for devices), or
• Manage the sensitive data of more than 200,000 individuals.

Large Data Holders are subject to stricter regulations, including:

• Publishing a decade’s worth of privacy policies and offering a concise version,
• Reporting to the FTC on data subject rights requests,
• Maintaining both a data privacy officer and a data security officer,
• Conducting regular privacy impact assessments, particularly for algorithms.

Sensitive Data

As is common with privacy regulations, the APRA designates a special category for sensitive data, defined broadly to include:

• Government identifiers,
• Health and biometric information,
• Genetic data,
• Financial details,
• Precise geolocation,
• Log-in credentials,
• Private communications,
• Data revealing sexual behavior, among others.

The APRA requires consumers to opt into the collection and use of sensitive data affirmatively. Non-sensitive data can be processed provided consumers are informed and can withdraw consent.

Required Data Privacy/Security Officer

Mirroring aspects of the GDPR, the APRA mandates that businesses appoint a data privacy or security officer. While the role’s responsibilities are not fully detailed in the current draft, it is a requirement for all covered entities, with Large Data Holders needing to appoint both a privacy officer and a security officer.

Data Brokers

The APRA introduces specific regulations for data brokers, requiring them to register with the FTC if they affect the data of more than 5,000 individuals. This registration must be renewed annually, and brokers are required to maintain a website that facilitates data subject rights and opt-out requests, linking back to the FTC’s data broker registry.

Multi-Pronged Enforcement With a Private Right of Action

The APRA’s enforcement can occur through multiple channels:

• The FTC, which will treat violations as unfair or deceptive practices,
• State attorneys general, who can seek various forms of relief, including civil penalties and restitution, and
• Private citizens, who can sue entities that violate their rights under the Act.

The inclusion of a private right of action is particularly notable, as it allows individuals to directly enforce their rights, a provision that could become a focal point during legislative discussions.

How to compliant with the The American Privacy Rights Act (APRA)?

Use a consent management platform like UniConsent to offer consumers with full control over data collection, with opt-out capabilities that automate, streamline, and manage preference communications without expending additional time and effort.

Vertrauenswürdig bei über 5000 globalen Verlagen und Vermarktern

• 
• 
• 
• 
• 
•