RELEASE: EPIC Urges Support for Updated American Data Privacy and Protection Act

WASHINGTON, DC – Leaders on the House Energy & Commerce Committee today released an amended version of the American Data Privacy and Protection Act (ADPPA). EPIC commends the Committee for its work and has sent a letter to Committee members urging support of the amended bill. 

The ADPPA sets clear limits on how companies can collect and use data by setting data minimization rules. “Data minimization is absolutely critical because it makes privacy the default,” said Caitriona Fitzgerald, EPIC Deputy Director. “Data minimization takes the onus off users and requires that companies limit data collection to better align with what consumers expect.”

The American Data Privacy and Protection Act also recognizes that some sensitive categories and uses of data deserve stricter controls. The Amended Bill sets strong restrictions on the collection and use of sensitive data, including precise geolocation, biometric, and health information, as well as data identifying an individual’s online activities over time and across third party websites and online services. Companies may only collect and use these types of data if doing so is strictly necessary and may not transfer such data to third parties without the individual’s affirmative express consent. The ADPPA prohibits the use of sensitive data for targeted advertising purposes. EPIC believes that these protections directly limit the most harmful business practices that this law is intended to address.

ADPPA also extends civil rights protections online, requires algorithmic impact assessments, and gives users the right to access, correct, and delete data collected about them. The bill would also give all Americans the right to opt-out of targeted advertising, including through global opt-out settings.

The ADPPA’s three-tier enforcement structure sets it apart from other privacy laws. One of the biggest criticisms of the European Union’s General Data Protection Regulation (GDPR) is that it is not adequately enforced because enforcement is left to individual states where there are not adequate resources to ensure compliance. The ADPPA aims to avoid this issue by instead empowering enforcement authorities at the federal, state, and individual level.

The ADPPA does preempt some state privacy laws with a number of savings exceptions, but it is meant to set a national standard. “EPIC believes a national standard that sets a high level of protection for all Americans in critically important,” said Caitriona Fitzgerald, EPIC Deputy Director. “While we would prefer this bill set a federal floor, the privacy harms happening today are simply too dangerous to miss this opportunity to provide privacy protections for all Americans.”

“This is not a perfect privacy bill, but we do believe it would establish critical protections for Americans and make much needed advancements for privacy rights at a time when those rights are very much at risk,” said Alan Butler, EPIC Executive Director. “This is not the end of the process, it is the start of the process. The law will be strengthened over time via rulemaking and litigation. But it is past time to pass a federal privacy law.” 

EPIC has been calling on Congress to pass a comprehensive privacy law for more than 20 years. 

Resources:

EPIC letter of support of amended ADPPA: 

https://epic.org/wp-content/uploads/2022/07/EPIC-ADPPA-7.19.2022.pdf

Amendment in Nature of a Substitute:

https://docs.house.gov/meetings/IF/IF00/20220720/115041/BILLS-117-8152-P000034-Amdt-1.pdf

###

EPIC was established in 1994 to protect privacy, freedom of expression, and democratic values in the information age. EPIC pursues a wide range of program activities including policy research, public education, conferences, litigation, publications, and advocacy. EPIC routinely participates in regulatory and legislative processes to strengthen protections for personal data, files amicus briefs in federal courts defending privacy rights, pursues open government cases to ensure oversight of surveillance systems, and organizes civil society responses to emerging privacy issues. EPIC works with leading experts in law, technology, and public policy to identify and promote solutions to emerging and persistent privacy problems.

View PDF release.