//
APRA is the first federal privacy bill to gain notable bipartisan and bicameral support.
//
// Major benefits for consumers
If passed, the legislation would provide major benefits for consumers:
- It allows users to opt out of data practices like targeted advertising.
- It prevents companies from collecting data that is not “necessary” or “proportionate” to the purpose for which the data is collected.
- Groups that collect data would be required to disclose the data they have collected and give consumers the right to edit or delete it.
- It allows individuals to sue companies if companies fail to either obtain consent before collecting sensitive data or fail to fulfill the data deletion requests (the ability for individuals to sue has never been allowed before).
- Platforms are prohibited from using algorithms and data collection practices that are discriminatory on the basis of race, color, religion, national origin, sex, or disability.
// Major breakthrough for lawmakers
Spearheaded by a Republican in the House and a Democrat in the Senate (who are the respective chairs of the House and Senate Commerce Committees), the bill is notable because it is the first federal privacy bill to gain notable bipartisan and bicameral support.
Last year, this bill’s predecessor, the American Data Privacy and Protection Act (ADPPA), went further than any previous privacy bill but never made it to a House floor vote.
// Breaking the partisan logjam on two core issues
The proposed legislation also represents a major breakthrough for lawmakers who have struggled to pass a national privacy law due to disagreement over two core issues:
- Whether a new federal law should override state data privacy laws that are already in place.
- Whether consumers should be allowed to sue companies directly that violate their privacy in civil suits.
For APRA, the answer is yes in both cases.
// Concerns
Some critics believe that the bill has only been able to to garner bipartisan support and navigate around issues that were previously insurmountable because it has major flaws.
// Complication #1: states' rights
The most contentious issue of the APRA is how the proposed legislation would override over a dozen existing state laws on data privacy, some of which are more comprehensive than what’s outlined in the bill.
For example, the Electronic Frontier Foundation expressed concerns that the new federal bill would prevent states from creating stronger protections in the future and freeze consumer data privacy protections in place.
“Federal law should be the floor on which states can build, not a ceiling...The ability to pass stronger bills at the state and local level is an important tool in the fight for data privacy,” EFF published recently in comments about APRA.
Fifteen state attorneys general also shared the concern that the APRA could undercut states’ privacy bills, calling Congress to prevent the bill from preempting state consumer privacy laws.
// Complication #2: broad compliance
APRA’s restrictions would apply to the biggest tech companies, as well as across the private sector to any medium or large organization that handles data, including large nonprofits.
This has raised concerns about the cost of compliance for smaller companies and the unintended consequence of giving larger firms who can afford to comply an advantage over upstarts.
Of note, small businesses with less than $40 million in revenue and with data on fewer than 200,000 consumers would be exempt.
Whether these complications will prevent the passing of the bill remains to be seen, but they’re substantive enough for lawmakers to tweak the language to ensure they are not obstacles.
// Is this the big one?
This is an ambitious bill for a congress that has struggled to pass bills (this particular congress has been the least productive congress since the Great Depression).
The bill has a long way to go, but there’s reason to believe it doesn’t need to be perfect to be passed. The Children’s Online Privacy Protection Act (COPPA), which was passed in 1998, was broadened and updated in 2013.
For those who might believe APRA doesn’t go far enough, they might find solace in the example of COPPA being strengthened over time. APRA can serve as both a policy foundation upon which further improvements can be made and a precedent that could spur further action at all levels of government.
.png?width=1160&upscale=true&name=PL_expandtunnel%20(1).png)
