Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

USA: House Energy Committee passes amended Bill for American Data Privacy and Protection Act

The U.S. House Committee on Energy and Commerce announced, on 20 July 2022, that it had passed amendments to House Resolution ('HR') 8152, the American Data Privacy and Protection Act during the full Committee markup.

Who does HR 8152 apply to?

In particular, HR 8152 would apply to a 'covered entity' which is defined as:

  • any entity or person, other than an individual acting in a non-commercial context, that alone or jointly with others determines the purposes and means of collecting, processing, or transferring covered data and:
    • is subject to the Federal Trade Commission Act of 1914;
    • is a common carrier subject to the Communications Act of 1934;
    • is an organisation not organised to carry business for their own profit or that of their members; and
  • any entity or person that controls or is controlled by another covered entity.

In addition, HR 8152 outlines requirements for 'service providers' which is defined as a person or entity that collects, processes, or transfers covered data on behalf of, and receives covered data from or on behalf of, a covered entity, Federal State, Tribal, territorial, or local government entity.

What are the key obligations for covered entities and service providers?

HR 8152 establishes principles and obligations for covered entities and service providers handling covered data including:

  • permissible purposes for processing, collection, and transfer of covered data including conducting internal research or analytics to improve a product or service, as well as principles including data minimisation;
  • special requirements for the transfer of sensitive covered data such as expressed consent;
  • the establishment, implementation, and maintenance of reasonable policies, practices, and procedures regarding the collection, processing, and transfer of covered data;
  • procedures and requirements for the handling of consumer requests;
  • transparency requirements including information to be provided in privacy policies, as well as language requirements associated with the same;
  • prohibitions on targeted advertising to children and minors under the age of 17, as well as restrictions on the transfers of such children and minors covered data;
  • conducting privacy impact assessments;
  • conducting a covered algorithm impact assessments where a covered algorithm poses a consequential risk of harm to an individual or group of individuals; and
  • the establishment of data security practices including reasonable administrative, technical, and physical data security practices and procedures to protect and secure covered data against unauthorised access and acquisition.

What rights do consumers have?

HR 8152 establishes consumer rights including:

  • access;
  • deletion;
  • correction;
  • right to export covered data;
  • right to opt-out of covered transfers; and
  • right to opt-out of targeted advertising.

In regard to response times, HR 8152 clarifies that large data holders must respond to requests within 45 days unless it is clearly impracticable or very costly to verify such individual. However, covered entities that are not large data holders or do not fall under the small business protections will have 60 days to respond, whereas covered entities that fall under the small business protections will have 90 days to respond. Notably, HR 8152 permits an extension of 45 days taking into account the complexity and number of requests. However, the individual must be informed of the extension within the initial 45 days along with the reason for the extension. 

HR 8152 will now be submitted to the U.S. House of Representatives.

You can read the press release here, the amended HR 8152 here, and track its progress here.