United States: A PROPOSED FEDERAL PRIVACY LAW

The proposed U.S. Federal Privacy Law, the American Data Privacy and Protection Act (ADPPA) was introduced in the U.S. House of Representatives on June 21, 2022. This represents the first-time federal data privacy legislation in the United States has progressed to a full chamber vote.

The ADPPA applies to entities that fall into one of the following three categories:

• Entities subject to the Federal Trade Commission (FTC) Act
• For example, fall within the scope: tech companies collecting real-time physical health data from mobile applications or wearable fitness trackers (not covered entities under HIPAA)
• Common carrier subjects to title II of the Communications Act (1934) – Title II deals with telephone and telegraph common carriers.
• Nonprofits

By exception, Government and public entities will not be covered, nor will employee data. With respect to employee data, however, the exclusion is narrow. Data resulting from employee surveillance would not be outside the scope of the law. Note that the California Privacy Right Act (CPRA) (effective January 1, 2023) would regulate employee data (assuming the sunset clause is not lifted).

Compared to the California Consumer Privacy Act (CCPA), the federal bill is intended to be broader (including additional requirements for “large data holders”), particularly since the CCPA does not cover non-profits.

The list of Sensitive Covered Data includes social security number, passport number, (past, present, future) physical health, mental health, diagnosis, financial account number, debit card number, biometric and genetic data, precise geolocation, private communications (voicemails, emails, texts, direct messages,…), information about kids, etc.

In this context, Sensitive Covered Data are based on the opt-in principle, which means that affirmative and express consent must be obtained, that data cannot be transferred to third parties without the consent of the person concerned, and which expressly prohibits dark patterns and inferred consents.
In contrast, the CCPA provides for an opt-out principle.

Where transparency is only a focus point for state laws, the federal law goes further by recognizing that bombarding consumers with notices that most will never read does not protect information. These privacy notices must meet a certain standard.

The ADPPA also requires that the privacy notice disclose whether data is collected, transferred, disclosed, processed, stored or accessed to the People’s Republic of China, Russia, Iran, or North Korea.

The ADPPA would provide subjects various rights over covered data, including rights of access, correction and deletion of their data held by a particular covered entity. It would further require covered entities to give subjects the right of data portability. These rights may be subject to exceptions, including because of the FTC’s rulemaking authority.

Any massive data holder/social media giant will be held to a higher standard than smaller companies. These large companies will have to demonstrate annually a certificate of compliance with the regulations.

Any entity with more than 15 employees will have to appoint a privacy and data security officer.

The enforcement strategy is divided into three areas:

• New Office of Privacy at the FTC to enforce the law
• Individuals’ private right of action
• State Attorneys Generals and state privacy agencies can also bring lawsuits

Also, it is expected that the FTC can create “technical compliance programs” to help companies comply with the law.

The Private Right of Action (PRA) will not be available until two years after the ADPPA’s effective date. Of note, the ADPPA would go into effect one-hundred and eighty (180) days after enactment. Therefore, ultimately, the PRA would be delayed approximately two-and-a-half (2.5) years after the ADPPA passes.

But even before its potential entry into force, the picture is already unclear as to the chances of the discussion draft becoming law… and the many debates it provokes.

For example, where the Republicans want the federal bill to preempt state laws, the Democratic Party does not. Also, where Republicans do not want to establish the PRA, Democrats want it to be specifically established. The federal bill decides that it will preempt most state laws and allow the PRA. Especially, preemption would only be valid to the extent that it governs the same issues (e.g., the CPRA would be preempted except for employee data).

Although still in the federal bill stage, it is running up against Californians who are very concerned about the impact that ADPPA will have on the rights that they already enjoy. In fact, California Democrats would even like to be exempt from the federal standard.

In any event, a number of bipartisan amendments have already been adopted during the review. One would have changed the bill’s preemption provision to allow states to create stricter laws.
It remains to be seen whether the bill will be introduced and voted on in each federal chamber of the U.S. Congress to become effective…