Comparison with the 2022 Draft Data Privacy and Protection Law

Definitions

Main Content of the APRA

1. Data Minimization

• Limited Purpose for Providing Products or Services The APRA bill strictly specifies the reasons for entities to collect, process, retain, or transfer data. Entities can only do so within a necessary, appropriate, and limited scope for specific reasons such as:
1. Ensuring data security, spam prevention, and diagnosing, debugging, or repairing networks and systems.
2. Compliance with federal, state, local, or tribal laws not superseded by the APRA.
3. Legal claims by the entity itself.
4. Transferring data to federal, state, local, or tribal law enforcement under a lawful order, administrative subpoena, or other legal process.
5. Executing product recalls or warranties under state or federal law.
6. Conducting market research.
7. De-identifying data for internal research or analysis to improve products or services, and for lawful and public scientific, historical, or statistical research projects.
8. Providing advance notice to affected individuals and relevant information, including the names and privacy policies of other entities receiving personal data, along with the opportunity to revoke consent and delete personal data before asset transfers in mergers, acquisitions, bankruptcies, or similar transactions.
9. Providing location information by telecommunications carriers or mobile services, (non-)connected VoIP services.
10. Preventing, detecting, investigating, or addressing fraud or harassment, excluding selling relevant data to the government.
11. Preventing, detecting, mitigating, or addressing ongoing or imminent cybersecurity or physical security events, including intrusions, medical alerts, fire alarms, or access controls.
12. Preventing, detecting, mitigating, or addressing imminent or ongoing public safety incidents like mass casualty events, natural disasters, or national security incidents, excluding selling relevant data to the government.
13. Preventing, detecting, investigating, or addressing criminal activities, excluding selling data other than health information to the government.
14. Processing data for first-party or contextual advertising relevant to the individual, excluding sensitive data and previously legally collected data.
15. Processing or transferring data for targeted advertising for individuals who have not opted out, excluding sensitive data and previously legally collected data.

• [New] Sensitive Data and Biometric Information The APRA bill adds extra protections for sensitive data and biometric information based on the 2022 draft. Any transfer of sensitive data or biometric information must first obtain explicit consent from the individual under the "minimization necessity principle." Additionally, the bill includes minor data within the sensitive data category, enhancing privacy protection for minors.
1. Explicit Consent: Transfer of sensitive information can only occur with explicit individual consent. For biometric and genetic information, there are legal exceptions to transfer without individual consent for the purposes listed above in points 2, 3, 4, 8, 9, 11, and 12.
2. Revocable: Individuals should be able to easily revoke their consent for the transfer of these types of information.
3. Retention Period for Biometric Information: Entities must adhere to the legal retention period for biometric information, which is either the period specified in the explicit consent or three years after the last interaction with the individual, whichever comes first.

2. Transparency of Privacy Policy

• Content of the Privacy Policy The APRA bill requires entities and service providers to publicly disclose their privacy policies in a clear, conspicuous, non-misleading, readable, and accessible manner. Policies must detail data collection, processing, retention, and transfer activities, including the identity and contact information of the data controller, the names of service providers, third parties, or data brokers involved, and the reasons for data transfers. Policies must also outline the entity's data security measures, the effective date of the privacy policy, and whether data may be accessed by adversarial nations.

• Access to and Opt-out of the Privacy Policy Privacy policies should be accessible to individuals with disabilities and easy to understand and obtain. For substantial or significant changes, entities must notify affected individuals in advance in a clear and conspicuous manner and provide a way to opt-out. For those who opt out, entities must cease processing or transferring their non-essential personal data. Additionally, entities must take all reasonable electronic measures to directly notify affected individuals in each available language.

• Additional Transparency Requirements for Large Data Holders The APRA bill imposes stricter transparency requirements on large data holders than on general entities:
1. Large data holders must keep and publish a log of privacy policies and significant changes for ten years.
2. Large data holders must send concise, clear, conspicuous, non-misleading, readily accessible notifications disclosing individual rights and attracting attention, not exceeding 500 words. The minimum data disclosure level and notification template are to be issued by the committee

3. User Rights Guaranteed by Entities

• Control over Personal Data
1. The APRA bill grants users control over their personal data, including the rights to access, delete, correct, and export personal data. Entities must verify the identity of the requester before these rights can be exercised to ensure the requester is the data subject or their authorized representative.
2. Frequency and Fees: Individuals can exercise their rights free of charge three times within 12 months; beyond that, entities may charge a reasonable fee.
3. [Change] Timing: The response time for large data holders or data brokers has been reduced from 45 days in the draft to 15 days, and for non-large data holders from 60 days to 30 days. Considering the number and complexity of requests, the response time may be extended once, but the individual must be notified of the extension and the reasons within the original response period.
4. Accessibility: Entities must ensure that persons with disabilities and users who speak different languages can access and use the data properly.

• [Change] Exceptions Where Entities May Deny a Request The APRA bill has adjusted the exceptions from the draft, moving some potential exceptions to necessary and explanatory exceptions, and has also added exceptions for data on devices.
1. Necessary Exceptions—In the following cases, entities must deny or partially deny an individual's request:
1. Unable to verify the requester.
2. Exercising the right requires access to someone else’s sensitive data.
3. The data is involved in executing a search warrant, subpoena, or litigation hold issued to the entity.
4. Violates the entity’s ethical obligations.
5. Requests made with fraudulent intent.
6. Requests made to facilitate criminal activity.
7. Agreeing to the request would threaten data security.
2. Potential Exceptions—After providing sufficient explanation, entities may deny or partially deny an individual's request for:
1. Technical or cost reasons making fulfillment impossible, but a large number of requests does not constitute a technical impossibility.
2. The data requested for deletion is necessary for the fulfillment of a contract between the entity and the individual.
3. Requests to access or export the entity’s trade secrets.
4. Prevents the entity from keeping confidential records of individuals opting out.
5. Involves deleting data necessary for the regular operation of educational institutions like schools.
3. Explanatory Rules—This section does not require entities to:
1. Retain data collected from one-time transactions.
2. Re-identify data that has been de-identified.
3. Collect or retain any data linking an individual's requests to the data concerned.
4. Exceptions for Data on Devices—If the data involved in a request is entirely on a device and can be directly accessed by the individual, the entity may deny requests for access to, correction of, or deletion of such data.

• Opt-Out Rights
1. Users have the right to refuse data transmission and opt out of targeted advertising.
2. [New] The APRA bill, compared to the 2022 draft, includes new provisions for a centralized consent and opt-out mechanism:
1. Defining opt-out preference signals: User interface should be friendly, descriptions clear, available in relevant languages, accessible to persons with disabilities, and not conflicting with other privacy settings of the individual.
2. Establishing a reasonable mechanism: Allows individuals to selectively opt out from certain entities without affecting their preference settings with others.
3. Neutral opt-out preference settings: The user interface may have at most two opt-out preference signal options to ensure neutrality.

• [New] Consequential Decision Opt-Out The APRA bill introduces the right for individuals to enable or disable features similar to "personalized recommendations."
1. In general, entities using algorithms to make or assist decisions must:
1. Notify the individual: Allowing them to use the algorithm.
2. Provide choice: Give individuals the opportunity to choose whether to use the algorithm.
3. Respect individual choices: Adhere to the individual’s choice to opt out of using the algorithm.
2. Such notifications should be:
1. Clear, conspicuous, and non-misleading: Ensuring the notification is understandable and does not cause misunderstandings.
2. Provide meaningful information: Explain how the algorithm makes or facilitates decisions, including potential outcomes.
3. Multilingual: Notifications should be available in all languages used by the entity.
4. Accessible: Ensure that persons with disabilities can reasonably understand the notification content.
3. Definition of "Consequential Decision": In this section, a "consequential decision" refers to using the data covered by this law involving decisions or offers, including through advertising, related to: 1. An individual or a category of individuals obtaining or equally enjoying opportunities in housing, employment, education, healthcare, insurance, or credit; or 2. The use or restriction of the use of any public place.

• Prohibition of Dark Patterns and Retaliation Against Users The APRA bill builds on the draft by adding requirements to prohibit entities from using "dark patterns" to distract users from privacy policies and change notifications, preventing entities from inducing decisions or hindering the exercise of rights during service provision. The bill also adds that entities conducting voluntary market research may offer different services and pricing.
1. [New] Prohibition of Dark Patterns: Relevant entities are prohibited from using "dark patterns" to divert an individual's attention from notifications required by this law, hinder the individual's exercise of any request or opt-out rights under this law, or directly obtain, infer, or guide individual consent for any action requiring autonomous consent under this law.
2. Autonomy of Individuals: Relevant entities may not limit an individual's exercise of rights under this regulation using any false, fictitious, fraudulent, or significantly misleading statements or representations.
3. Prohibition of Retaliation Through Services or Pricing
1. Relevant entities are prohibited from retaliating against individuals exercising their rights under this law by refusing to provide products or services, charging different prices or rates for products or services, or providing different quality levels of products or services.
2. [New] Exception: Non-high-impact social media companies or data brokers' relevant entities may offer goodwill loyalty programs or market research incentives to individuals, and may refuse to provide products or services if necessary.

4. Data Security and Protection Responsibilities of Entities

1. Regular identification and evaluation of internal and external vulnerabilities with timely protective actions.

2. Implementation of preventive and corrective measures to reduce vulnerabilities and establish corresponding assessment mechanisms.

3. Management of information retention and disposal issues, such as destruction, permanent deletion, or other modifications of data required to be deleted by law, ensuring data is unrecoverable.

4. Conducting data protection training for employees.

5. Establishing response procedures for data security incidents.

5. Special Entities: Third Parties

• Service Providers and Third Parties
1. Service Provider Responsibilities
1. Service providers must comply with the instructions of the relevant entities and assist them in fulfilling obligations under the APRA.
2. If a service provider becomes aware of any violations of the act by the relevant entity, they should cease their data practices.
3. When subcontracting other service providers to handle or retain data on behalf of the entity, service providers must choose appropriately and provide written notification under a lawful written contract.
4. Service providers must maintain the security and confidentiality of regulated data and accept assessments by independent evaluators.
2. Contractual Content Between Service Providers and Their Represented Entities
1. Contracts should govern the procedures for collecting, processing, retaining, or transferring data performed by the service provider on behalf of the entity.
2. Contracts should specify the instructions, nature, and purpose of collecting, processing, retaining, or transferring data, the type of data, the duration, and the rights and obligations of both parties.
3. Contracts should prohibit the waiver of legal duties by either party.
4. Contracts should prohibit unlawful data practices.
5. Except as required by law, contracts should prevent service providers from mixing data with data collected from other entities, service providers, or individuals.
3. Third-Party Responsibilities
1. Third parties may only process, retain, and transfer third-party non-sensitive data received from other entities, or process, retain, or transfer third-party sensitive data when individuals have explicitly consented to the transfer.
2. After due diligence, third parties may reasonably believe the representations made by the transferring entity regarding data disclosure, thus exempting them from the privacy policy obligations stipulated by this regulation.
4. [New] Interpretative Rules Added by the APRA
1. Continued Unlawful Conduct: If an entity transfers data to a service provider or third party without actual knowledge or reasonable suspicion of intentional violation of this law by the service provider or third party, the entity is not considered in violation of this law. If the entity knows and has reason to believe that the service provider or third party will violate this law, it should immediately stop transmitting data to them.
2. Past Unlawful Conduct: An entity that collects, processes, retains, or transfers data in accordance with this law is not considered unlawful if the entity receiving the data or acting on its behalf violates this law.
5. Due Diligence: Relevant entities must conduct due diligence when selecting service providers and deciding to transfer data to third parties. The FTC will issue due diligence guidance within two years.

• Data Brokers: [Change] The APRA has redefined third-party data collectors as "data brokers" in the draft, but the core content remains unchanged.
1. Notification: Data brokers must establish and maintain a publicly accessible website. On this website and other mobile applications, they should place clear and prominent notices, including links to the data brokers' registration office website.
2. Prohibition: Data brokers are prohibited from accessing or transmitting data for purposes such as tracking harassment, committing fraud or theft, or distorting standard business practices within an industry.
3. Registration: Data brokers affecting 5,000 or more individuals annually must register by January 31 of the following year and offer a "Do Not Collect" mechanism at the time of registration. Data brokers are required to pay a $100 registration fee to the committee and provide legal name, primary address, email address, internet address, type of data, contact person’s name, monitoring phone, monitoring email address, website, and actual mailing address. Data brokers must also include links on their websites to facilitate individuals in exercising their rights.
4. "Do Not Collect" Mechanism: The committee will establish and maintain a searchable public registry of data brokers' registration information. This registry allows the public to search and identify data brokers and includes a mechanism for individuals to submit a "Do Not Collect" request to registered data brokers who are not acting as user reporting agencies, ensuring that data brokers no longer collect data related to that individual without their explicit consent, except when data brokers act as service providers. Data brokers that receive a "Do Not Collect" request must comply within 30 days unless they are aware that the individual has been convicted of crimes related to child abduction or sexual assault, or if the data collected is necessary for national or state sex offender registries or as part of a nonprofit national resource center and information exchange authorized by Congress to assist victims, families, child service professionals, and the public with missing and exploited children.
5. Penalties: Data brokers who violate regulations will be subject to civil penalties under subsections (l) and (m) of the Federal Trade Commission Act. Data brokers who fail to register as required will incur a fine of $100 per day, with an annual maximum of $10,000. Data brokers that fail to provide notifications as required will also face a daily fine of $100, not exceeding $10,000 annually.

6. [New] Privacy-Enhancing Technology Pilot Program

• Definition of Privacy-Enhancing Technology: Refers to any software or hardware solution, encryption algorithm, or other technology that extracts the value of information without compromising privacy and security, including technologies with capabilities similar to homomorphic encryption, differential privacy, zero-knowledge proofs, synthetic data generation, federated learning, and secure multi-party computation.

• General Provisions: The commission should establish and implement a pilot program within one year of the enactment of this bill to encourage the private sector to use privacy-enhancing technologies to advance the applicability of this law.

• Application Process: Entities wishing to participate in the pilot program should submit an application to the commission according to the timing, form, and method required by the commission, demonstrating the entity's capability to use privacy-enhancing technology for data security practices that meet or exceed the requirements of this law.

• Liability Limitations: Any entity participating in the pilot program should:
1. Take any action under Sections 17 or 18 for violations of Section 9.
2. Have the right to a rebuttable presumption of compliance for individual lawsuits alleging data security breaches.

• Ongoing Audits: The commission should continuously audit each entity participating in the pilot program to ensure adherence to the use and implementation of privacy-enhancing technology for data security.
1. If at any time the commission determines that a participating entity no longer adheres to the use of privacy-enhancing technology, the commission should revoke the entity's eligibility and the above liability limitations and notify the entity of this decision.
2. Remediation Opportunity: The entity has 180 days from the receipt of notification to remediate and must submit a remediation proposal to the commission. If the commission deems the remedial measures sufficient to address the deficiencies, it cannot revoke eligibility based on them.

• Coordination: In implementing the pilot program, the commission should seek input from private, public, and academic stakeholders and consult with the Secretary of Commerce to develop ongoing participation in the public and private sectors, disseminating voluntary, consensus-based resources to increase the integration of privacy-enhancing technologies in data collection, sharing, and analysis in the public and private sectors.

• Research and Reports by the United States Government Accountability Office:
1. Research: The Comptroller General of the United States (referred to as "Comptroller General" in this section) should conduct a study within three years of the enactment of this law to evaluate the progress of the pilot program, assess the use of privacy-enhancing technology by the commission, support the oversight of entity data security practices, propose improvements and promote work to protect privacy rights, and suggest improvements in communication and coordination between entities and the commission.
2. Preliminary Briefing: Within one year of the enactment of this law, the Comptroller General should brief the Senate Committee on Commerce, Science, and Transportation and the House Committee on Energy and Commerce on the preliminary results of the research conducted.
3. Final Report: 240 days after the preliminary briefing, the Comptroller General should submit a final report to the Senate Committee on Commerce, Science, and Transportation and the House Committee on Energy and Commerce, presenting the results of the research.

• Termination: The commission should terminate the pilot program within ten years from the start date of the program.

Regulatory Analysis

1. What new obligations do businesses (referred to as entities in this law) have relative to the 2022 draft? The APRA bill stipulates that businesses must follow strict and exclusive reasons when collecting, processing, retaining, or transferring data, and must obtain individual consent before transferring sensitive and biometric information. Notably, the regulation classifies minors' information as sensitive, prohibiting its transfer without consent. The APRA sets the "applicable minor" age to under 17 years old, which is stricter than the current focus of most U.S. businesses on privacy compliance for children under 13. If the APRA bill is enacted, businesses will need to expand and adjust their compliance plans accordingly. The APRA bill also requires businesses to provide channels for users to exercise their rights to access, delete, modify, and export information. Additionally, businesses must offer an opt-out mechanism that allows users to opt out of "consequential decision" algorithms. Businesses are prohibited from using "dark patterns" to interfere with user rights and from retaliating against users.

2. Business Privacy Compliance: What do businesses need to do? According to the APRA bill, businesses need to publicize their privacy policies and notify users in advance of significant changes to ensure transparency of the privacy policy. Businesses should establish mechanisms for preventing and correcting data security risks and regularly assess and improve these mechanisms. Furthermore, businesses must appoint privacy and data security officers to ensure compliance with data processing. Large data holders face stricter requirements in terms of privacy policy transparency, verifying and facilitating user rights, internal management responsibilities, and submitting metric reports. These requirements include publishing privacy policies and annual transparency reports for the past ten years, appointing a privacy officer and a data security officer, and submitting metric reports. Large data holders also need to conduct audits and privacy impact assessments every two years; when artificial intelligence poses a significant risk of harm to specific groups, they must submit annual algorithm impact assessments to the FTC. Additionally, high-impact social media, data brokers, service providers, and third parties have specific obligations to comply with.

• https://energycommerce.house.gov/posts/committee-chairs-rodgers-cantwell-unveil-historic-draft-comprehensive-data-privacy-legislation - News Report

• https://d1dth6e84htgma.cloudfront.net/American_Privacy_Rights_Act_of_2024_Discussion_Draft_0ec8168a66.pdf - American Data Privacy and Protection Act of 2024 Draft

• https://www.congress.gov/bill/117th-congress/house-bill/8152/text#toc-HBA3C89312046433D92297CB0CB30DE69 - American Data Privacy and Protection Act of 2022 Draft