Latest Update on the American Privacy Rights Act

APRA Changes

The latest draft of the American Privacy Rights Act (APRA) was released on June 20, 2024. Though sections concerning data minimization, universal op-out and deletion mechanisms, and privacy by design requirements remain intact, the “civil rights and algorithms” and “opt-out rights for consequential decisions” sections have been removed entirely.

The “civil rights and algorithms” section was perhaps the most glaring section to be excised from the legislation, as it would have mandated the implementation of standard AI governance practices and guaranteed certain civil rights when it comes to the collection or processing of personal information. The section on “opt-out rights for consequential decisions” mirrored state-specific privacy legislation that provides an opportunity to opt out of automated decision-making.

The bill’s latest revisions have garnered resounding pushback from groups including the ACLU, the Lawyers’ Committee for Civil Rights Under Law, and the Center for Democracy and Technology. Many fear that the legislation has been stripped of its most important civil rights protections and fundamentally weakens the American people’s overall digital privacy.

Civil Rights & Algorithmic Bias

By removing the section that addresses civil rights and algorithmic bias, its drafters have effectively eliminated the only language that explicitly prohibited entities from using personal data to discriminate against individuals “on the basis of race, color, religion, national origin, sex, or disability.”

The section would have also required that entities who collect or process large amounts of personal data and utilize automatic algorithms to make a “consequential decision” about the individuals whose information is collected to undergo “impact assessments” by independent third parties, who would ensure that entities refrain from engaging in discriminatory practices.

This key anti-discrimination section originally made up over 13 of the bill’s total 174 pages and its deletion is a significant amendment. The Lawyers’ Committee for Civil Rights Under Law notes: “The latest version of APRA does not sufficiently protect our rights. By removing previously agreed upon bipartisan language that would address data-driven discrimination and require AI impact assessments, the new draft of APRA fails to address the core purpose of privacy: to ensure that who we are cannot be used against us unfairly. This is unacceptable.”

Opt-out Rights for Consequential Decisions

The section for “opt-out rights for consequential decisions” would have provided individuals the ability to opt-out of AI decision-making for major economic opportunities and other consequential decisions.

Along with providing individuals the ability to opt-out, the section would have implemented significant algorithmic bias guardrails and provided critical oversight for entities who use AI to decide whether individuals can get access to housing, education, insurance, healthcare, employment, credit and various other economic opportunities. Not only would entities using such technology be required to go through periodic impact assessments, the section would have also allowed individuals to opt-out of letting algorithms make such consequential decisions altogether.

Personal Information Collection

Lastly, the latest draft of the APRA creates a substantial loophole for personal information collected and used on an individual’s device. The definition of “covered data” has been amended to exempt “on-device data.” As a spokesperson for the ACLU pointed out, this exemption could allow a company to  “… very easily place an advanced algorithmic system on your phone and use the data on your device already to make decisions.”

Theoretically, for personal information that’s contained exclusively on one’s personal device, there would be no data minimization rules, no advertising limits, no transparency requirements, and no civil rights safeguards. As AI technology advances and strengthens by the day, many fear that this “on-device” loophole will only grow larger, making the need for effective privacy protections even greater.

Because of these deletions and others, the latest draft of the APRA risks making any federal data privacy legislation weaker than the state-specific data privacy laws it would preempt.

Looking Ahead

Though the fate of the APRA and its path to enactment is dubious, there are many who feel that the core principles of data privacy and protection remain unharmed in the legislation’s latest update. However, on the morning of June 27, 2024, the House Energy and Commerce Committee seemed to heed critics’ calls for postponement of review, abruptly cancelling its plans to proceed with a formal markup of the bill.

Opponents of the legislation have said they will continue to push for further revisions while they wait for the Committee to take it up again. For additional reading, the Library of Congress hosts the current draft of H.R.8818 – American Privacy Rights Act of 2024, and you can contact the Hall Booth Smith Data Privacy & Cybersecurity team with any questions.

Disclaimer

This material is provided for informational purposes only. It is not intended to constitute legal advice nor does it create a client-lawyer relationship between Hall Booth Smith, P.C. and any recipient. Recipients should consult with counsel before taking any actions based on the information contained within this material. This material may be considered attorney advertising in some jurisdictions. Prior results do not guarantee a similar outcome.