What Consumers Need to Know About The American Data Privacy & Protection Act

Written by Taylor Rivich
Taylor serves as in-house counsel at AXEL, a Las Vegas-based software development company utilizing decentralized, distributed technology to promote data custody.

The American Data Privacy & Protection Act (ADPPA) is currently working its way through Congress. The ADPPA is essentially the American equivalent of the EU's General Data Privacy Regulation (GDPR) and recognizes privacy rights as civil rights. Here's what this historic bill means for you, as a consumer:

National Framework

The ADPPA creates a unified, national framework for consumer privacy protection. The ADPPA largely supersedes existing comprehensive privacy legislation at the state level. For example, Californians’ rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) are largely swallowed up by the ADPPA.

Consumer Rights

The ADPPA grants you numerous rights, including: the right to access and export the data a business collects about you, the right to know how the business discloses that data to third parties, the right to correct your data, and the right to delete your data. Furthermore, the ADPPA gives you the right to consent to and opt-out of the collection of your most sensitive data (health data, credit card numbers, Social Security numbers, biometric and genetic information, precise geolocation data, and more).

Algorithmic Bias

The ADPPA also addresses the issue of algorithmic bias. Under the ADPPA, businesses cannot employ algorithms which collect data in a discriminatory manner or lead to discriminatory impacts on members of protected classes. For example, an algorithm designed to assess your credit-worthiness must not process your personal information in a way which negatively impacts housing opportunities for women or minorities.

Private Right of Action

The ADPPA also gives consumers the right to sue businesses which mishandle your personal information. However, this right is subject to limitations: (1) The private right of action does not kick in until four years after the ADPPA takes effect, (2) even then, businesses have 45 days to cure any violations, (3) then you must notify the Federal Trade Commission (FTC) and your State Attorney General (AG) Office of your intent to sue, (4) the FTC or AG may choose to sue in your place, (5) but, if not, only then are you allowed to deliver a demand letter and commence litigation.

Minors

Finally, under ADPPA, online advertisers are prohibited from sending targeted advertisements to minors under 17 years old. And any data belonging to minors cannot be transferred to any third party without express parental consent.

Conclusion

The ADPPA, as currently drafted, is a major victory for privacy rights! In today's digital age, it is more important than ever to protect consumer data, and the ADPPA accomplishes this for even our most vulnerable populations.