Proposed American Privacy Rights Act of 2024: National Consumer Data Privacy Rights and Regulation of AI

The Proposed American Privacy Rights Act of 2024 is making waves in the US as it seeks to establish national consumer data privacy rights, regulate Artificial Intelligence and automated decision-making, impose obligations on high-impact social media companies and large data holders, supersede state privacy laws, and allow for a private right of action. The bipartisan bill, known as the American Privacy Rights Act (APRA), was introduced by US House of Representatives member Cathy McMorris Rodgers and Senator Maria Cantwell, aiming to give people control over their personal data and create a uniform national privacy standard.

If passed, the APRA would apply to businesses under the authority of the Federal Trade Commission, common carriers, nonprofits, and service providers processing data on behalf of Covered Entities. The bill would require these entities to minimize data processing, implement data security measures, and provide consumers with rights to opt out of targeted advertising and manage their data.

One key aspect of the APRA is the heightened obligations it imposes on high-impact social media companies and large data holders. High-impact social media companies would need to treat user data as sensitive, impacting their ability to use data for targeted advertising. Large data holders would have to meet transparency requirements, including retaining and publishing privacy policies for the previous 10 years and providing concise notices of data practices.

The APRA also addresses the regulation of automated decision-making, with specific provisions for covered algorithms that make decisions based on data. Entities using these algorithms would need to evaluate and assess the impact of their models, especially for decisions related to housing, employment, education, healthcare, and more.

Additionally, the APRA introduces a private right of action, allowing consumers to file civil suits against entities for violating their privacy rights under the bill. This provision gives individuals the opportunity to seek damages, relief, and legal costs for violations related to data minimization, transparency, individual control over data, and more.

Overall, the APRA aims to establish a comprehensive federal privacy framework, preempting state laws and providing Americans with consistent data security and privacy protections. If passed, businesses may face increased liability exposure, especially in relation to data handling and privacy practices.