US is one step closer to federal consumer data privacy protection

Blog Post

In 2002, California was the first state to enact a data breach security notification law. Since then, all 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have followed suit. 

In recent years, the focus has shifted towards a more proactive approach to data privacy and, in 2018, California was the first state to enact a comprehensive privacy law – the California Consumer Privacy Act (CCPA). Colorado, Connecticut, Utah and Virginia have since enacted their own versions of a consumer privacy act. These acts aim to provide a more comprehensive regulatory structure for data privacy and data protection, and impose certain requirements on businesses for the collection, maintenance and dissemination of consumer data. The CCPA has already been amended, with the California Privacy Rights Act (CPRA) set to go into effect on January 1, 2023.

As one of the few large nations without national privacy legislation, protecting consumers’ personal information has fallen squarely on the states, until now. The American Data Privacy and Protection Act (ADPPA), introduced as H.R. 8152 in June, advanced out of a House panel with a 53-2 vote on July 20, 2022.

What is the ADPPA?

The ADPPA follows on the privacy legislation and regulations that have come before, specifically on the privacy principles, data collection prohibitions, and notice and consent requirements as laid out in the General Data Protection Regulation (GDPR), as well as the CCPA and similar state laws. The ADPPA includes some of the following key takeaways.

Privacy by Design

Businesses will be required to implement, maintain and enforce policies that protect the security and integrity of information it collects.

Limiting the data businesses can collect for one of 17 enumerated purposes

As expected, a majority of the permitted purposes focus on completing business transactions, authenticating users and preventing fraud. Targeted advertising, while greatly restricted, is also an acceptable purpose which has been a sticking point for some advocacy groups.

Granting individuals ownership and control over their data

The ADPPA gives individuals the right to access, correct, and delete their data. Under the current version, businesses will have between 45 – 60 days to respond to these requests. The timing of the response is dependent upon size of the business.

A private right of action to sue a company for violation of the ADPPA

An individual will have two years from any violation of the ADPPA to file suit.

Specific provisions and caveats depending on the size of the companies

If a business meets certain requirements pertaining to revenue and data collection it can be declared a small business and request certain exemptions.

The ADPPA does not preempt any of the state breach notification laws, however, it does preempt the drafting and enforcement of state consumer protection laws that address topics such as privacy by design; data minimization and purpose specification; individual rights to access, correct, and delete personal information; and other data protection requirements. While the ADPPA will provide greater protection for the majority of Americans, those states who have previously enacted their own privacy laws are concerned about losing ground. The California Privacy Protection Agency board voted to oppose H.R. 8152 arguing that it “seeks to significantly weaken Californians’ privacy protections by pre-empting the California Consumer Privacy Act and other state privacy laws.”

As such, there are still some roadblocks and challenges for the current version of the ADPPA and it will likely progress through several more iterations before it is put to a full House vote. We will continue to provide updates on this historic legislation; however, as the need for privacy policies to grow, our national Data Privacy and Cybersecurity Practice Group provides pre and post breach services that will ensure you are compliant with all regulations.

Jump to Page

McDonald Hopkins uses cookies on our website to enhance user experience and analyze website traffic. Third parties may also use cookies in connection with our website for social media, advertising and analytics and other purposes. By continuing to browse our website, you agree to our use of cookies as detailed in our updated Privacy Policy and our Terms of Use.