Featured Bi-Partisan US Federal Privacy Bill ADPAA Gains Momentum

Published on February 28th, 2023 📆 | 3202 Views ⚑

0

Bi-Partisan US Federal Privacy Bill ADPAA Gains Momentum


https://www.ispeech.org

  • Data protections for children and minors:
      • Prohibition on targeted advertising to individuals under the age of 17
      • Consent for data transfer required from the individual or a parent or guardian if the individual is between 13 and 17 years of age

    • The draft act places additional requirements on third parties that collect individuals’ data and provides for a third-party collecting entity registry. The registry will be maintained by the FTC and contain all registered entities with their name, contact information, description of categories of data the entity processes and transfers, plus a link to their website where an individual may easily exercise their rights provided by the act. In addition, there is a proposed “do not collect” link to allow individuals to submit a request to all registered third-party collecting entities to delete the individual’s data and opt-out of future collection with consent

      •  

      Title III – Corporate Accountability – under this section, entities considered large data holders will be subject to broader requirements intended to ensure compliance and increase transparency:

       

      • Annually attest compliance with the act by the chief executive officer, privacy officer and security officer, ensuring internal controls and reporting structures that certifying officers are involved in, and responsible for, decisions impacting compliance
      • Biennial Privacy Impact Assessments must be conducted to weigh the benefits of the large data holder’s covered data collecting, processing and transfer practices against potential adverse consequences to individual privacy
      • Technical compliance programs specific to any technology, product, service or method used by a covered entity to collect, process or transfer covered data shall be evaluated through a process determined by the commission, the details of which shall be made publicly available to any individual whose covered data is subject to the solutions

       

      Finally, Title IV outlines Enforcement, Applicability and Miscellaneous provisions. Highlights include:

       

      • The FTC will establish a new bureau concerning consumer protection and competition to enforce the act no later than one year after enactment
      • An Office of Business Mentorship shall be established with the bureau to provide compliance guidance
      • Establishment of a “Victims Relief Fund”
      • Enforcement by state attorneys general
      • Private right of action
      • Right to Cure (45 days)

       

      The ADPPA shall preempt state privacy laws with the exception of the Illinois Biometric Information Privacy Act and Genetic Information Privacy Act, Section 1798.150 of the California Civil Code (security provisions of CPRA) and other laws that solely address facial recognition, unsolicited marketing, health information and/or confidentiality of library records. Nor does the proposal change obligations of a covered entity under the Children’s Privacy Protection Act of 1998 (COPPA).

       





       

      What Comes Next?

      The bill will progress according to standard congressional process. As there’s sure to be debate and edits to the current draft, it’s unlikely the bill will pass before the end of the current congressional session. Whether this bill or another, a federal privacy law will eventually unite the patchwork of U.S. privacy legislation under a cohesive, comprehensive consumer data protection law.

       

       

      How to Prepare?

      As federal and state privacy legislation continues to be debated, there are several steps companies can take to position themselves well for the future:

       

      • Monitor and assess privacy practices against current and forthcoming state laws – the clock is already ticking for California, Virginia, Colorado, Utah and Connecticut. Ensure your company is in compliance as the enforcement dates come to pass
      • Incorporate industry best practices – assess your company’s readiness against common threads across U.S. and international privacy laws. Support for the individual’s (data subject’s) privacy rights, impact assessments and applying privacy principles (such as purpose limitation, data minimization and accountability), as well as implementing Privacy by Design, will put your company in a strong position to respond as more individuals realize data privacy rights and protections
      • Start small – don’t have a privacy function or program in place? It’s okay. There are steps to take at any point in your company’s privacy journey to increase and right-size privacy protections for the individuals whose data you collect to prepare for the next evolution of legislation – whether that be at the state, sector or federal level

       

      If you have questions about this draft legislation and how it might affect your organization, please drop us a line.

      Source link

      Tagged with: • • • • • • • • • • • • • •



      Comments are closed.






      Š Torchsec  Privacy Policy Disclaimer  T&C



      Back to Top ↑