A new bill that would establish a federal data privacy law for the first time in the United States has been published as a discussion draft. 

The American Privacy Rights Act (APRA) is endorsed by representatives of the Democratic and Republican parties, and the Senate and the House of Representatives, but even if a bill is introduced soon it has a long way to go before making it into law, and an election is looming. However, the APRA has the potential to be a milestone moment in US legal history and it could drastically reshape the way businesses, particularly data-heavy businesses, are required to operate in the US.

The APRA follows years of partisan deadlock and failed attempts at federal privacy legislation, during which a number of state legislatures have taken it upon themselves to implement their own privacy legislation, while others have lagged behind, leaving a complicated patchwork of privacy laws across the US. The current state of US privacy law lags behind even pre-GDPR Europe, as the GDPR was preceded by a 1995 Data Protection Directive which required member states to adopt a single set of data protection principles into their domestic environments. No single standard currently applies across the US as a whole, and the issue of how US organisations protect personal data in practice has been continually litigated in the European courts (we’ve written about this here, and you can find a recent update on the EU’s view of New Zealand here).

The co-sponsors of the APRA, House Committee on Energy and Commerce Chair Cathy McMorris Rodgers (R-WA) and Senate Committee on Commerce, Science and Transportation Chair Maria Cantwell (D-WA), claim the proposed bill “is the best opportunity we’ve had in decades to establish a national data privacy and security standard that gives people the right to control their personal information”.

What does the American Privacy Rights Act cover?

The APRA overrides all state data privacy and data security legislation and replaces it with a “uniform national data privacy and data security standard”. States will no longer be permitted to legislate on privacy matters, with some limited exceptions (and certain specific state laws will also remain in effect)

The APRA applies to: 

• “covered data”, being “information that identifies or is linked or reasonably linkable, alone or in combination with other information, to an individual or a device that identifies or is linked or reasonably linkable to 1 or more individuals”, but excluding de-identified data, employee information and publicly available information; and
• “covered entities”, being entities that, alone or jointly with others, determine the purposes and means of collecting, processing, retaining, or transferring covered data and are either subject to the Federal Trade Commission Act, a “common carrier” under the Communications Act or a non-profit, but excluding certain government entities, small businesses and specified non-profits.

At first glance, it appears that the APRA incorporates a number of recognisable concepts from the GDPR, some (but not all) of which are reflected in the New Zealand and Australian Privacy Acts. Examples include:

• Covered entity vs service provider: While the APRA doesn’t expressly refer to data controllers and processors, it specifies that an entity will not be a covered entity insofar as it is acting as a ‘service provider’, defined as “an entity that collects, processes, retains, or transfers covered data for the purposes of performing 1 or more services or functions on behalf of, and at the direction of, a covered entity”. Essentially, it seems that the covered entity/service provider distinction is intended to mirror the GDPR’s controller/processor distinction without using the same terminology.
  
  
• Sensitive data: The APRA distinguishes between sensitive and non-sensitive data, with ‘sensitive’ data including government-issued identifiers, health information, genetic information, financial account information and credentials, and biometric information. 
  
  
• Data protection principles: The APRA categorises covered entities’ core obligations with respect to covered data under the principled concepts of data minimisation and transparency, which are concepts also present in the GDPR (and reflected in NZ and Australian laws).
  
  
• Data subject rights: Individuals have rights to request access to, and correction, deletion and portability of, their covered data. 
  
  
• Consent: Individuals must provide their affirmative express consent to certain transfers and uses of their data, including with respect to sensitive categories of data. Individuals must also be provided with an opportunity to opt out of certain other transfers and uses of their data (including targeted advertising and algorithm-based decision making).

One issue the APRA doesn’t address is notification of data breaches, although section 20(3)(D) anticipates that any data breach notification obligations under existing state laws will not be superseded by the APRA.

The APRA tackles some of the more nuanced aspects of data protection, such as the use of dark patterns, and the use of algorithms (including those derived by machine learning and AI techniques) by large data holders. It also extends the definition of sensitive data to include various ‘digital’ data of an individual, such as precise geolocation information, account or device log-in credentials, information that could be stored on a person’s phone or other device (such as calendar information, address book information, phone or text logs, and private photos, audio and videos), information about a person’s use of television and streaming services, and information about an individual’s use of websites and other online services.

Impact on New Zealand businesses?

If the APRA is passed in its current form, as with all foreign privacy laws there will be a question of extra-territorial application for New Zealand businesses. At this stage, it looks like the trigger will be whether a business is subject to the Federal Trade Commission Act. Given how contentious this proposed law is likely to be, we recommend New Zealand businesses sit tight and wait to see if and how things unfold, as we are at the first stage of an undoubtedly long journey towards a federal privacy law for the US – which may prove to be another non-starter.

A potential indirect impact of the APRA for New Zealand is that it could add fuel to fire regarding the Privacy Commissioner’s stated desire to upgrade New Zealand’s Privacy Act (see our summary of the Commissioner’s views here). While we haven’t carried out a side-by-side comparison of the APRA to the Privacy Act, it does appear to address some of the areas identified by the Commissioner as gaps in the Privacy Act, such as AI, automated decision making, sensitive information and children. Of course, whether the APRA adequately safeguards individuals’ rights with respect to these issues will require closer scrutiny of the text of the draft bill. 

Talk to the experts

Our privacy and cybersecurity experts Hayley Miller, Campbell Featherstone, Ashleigh Ooi and Güneş Haksever are on hand to answer all of your questions about your rights and obligations under the Privacy Act, and can direct you to local experts for advice on your rights and obligations under foreign privacy laws. You can also reach out if you’d like to know more about potential changes in this space in New Zealand, and how you can get involved in the regulatory reform process.

This article was written by Ashleigh Ooi, Senior Associate, in our commercial, technology and privacy team.