Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

USA: Bill for American Privacy Rights Act referred to full committee

On May 23, 2024, the House Energy and Commerce Committee published a blog announcing that the discussion draft of the American Privacy Rights Act was forwarded, without amendment, to the full committee by a voice vote. The bill defines several terms including 'affirmative express consent,' 'biometric information,' 'covered data,' and 'covered entity.' The bill also highlights the principles of data processing to include data minimization and transparency. 

Enforcement

If passed, the Federal Trade Commission (FTC) will be responsible for enforcing its provisions, namely by a bureau established within the FTC. Violations of the bill will be considered an unfair or deceptive act or practice pursuant to the FTC Act. However, the bill clarifies that a state Attorney General, the chief consumer protection officer of a state, or an officer or office of the state authorized to enforce privacy or data security laws may also bring a civil action. Notably, the bill provides that consumers may file private lawsuits against entities that violate their rights under the bill. 

Preemption of state laws

Concerning state privacy legislation, the bill expressly states that its purposes are to establish a uniform national data privacy and data security standard, and expressly pre-empts state laws. The bill states that it does not preempt state laws, rules, regulations, or requirements applicable to:

  • consumer protection laws of general applicability, such as laws regulating deceptive, unfair, or unconscionable practices;
  • civil rights laws;
  • provisions of laws that address the privacy rights or other protections of employees or employee information;
  • provisions of laws that address the privacy rights or other protections of students or student information;
  • provisions of laws that address data breach notification requirements;
  • contract or tort law; and
  • criminal laws unrelated to data or data security.

You can read the bill here and the blog post here.