APRA solves data breaches by increasing liability and minimizing the data companies have access to.

The U.S. Congress has been trying for several years now to adopt comprehensive federal legislation for privacy protection. In April 2024, a bipartisan and bicameral bill proposal was introduced in the form of a "discussion draft"1. This follows various attempts, including the American Data Privacy and Protection Act (ADPPA)2 of 2022, from which it borrows some elements. After the adoption of laws by states such as California or Illinois, Congress is aiming to take the lead and define a singular national approach that preempts state laws3 and aims to avoid a patchwork of laws. APRA also echoes the GDPR. 

Initial reactions seem rather positive4, acknowledging a significant legislative turning point and the rise of data protection. However, it is uncertain whether the law can be adopted before the end of the year given the U.S. political calendar (November elections).

The 4 objectives of the American Privacy Acts

Provide Americans with a fundamental right to digital privacy.

Create a national law regulating how companies can use personal data.

Limit companies' ability to track, anticipate, and manipulate individuals' behaviors for profit without their knowledge and consent.

Establish a uniform national standard for data privacy and security in the United States.

Summary of the bill5

The bill aims to establish consumer data privacy rights on a national level. It would require covered entities to be transparent about how they use consumer data and grant consumers the right to access, correct, delete, and export their data, as well as the ability to opt-out of targeted advertising and data transfers. 

It sets data minimization standards, allowing companies to collect and use only data ("covered data") for necessary and limited purposes (15 are defined, e.g., "protecting data security", "defending claims") for a specific product or service requested by the consumer. This minimization is unprecedented in U.S. law, except possibly in the recently adopted Maryland law6, according to the International Association of Privacy Professionals (IAPP)7. 

The transfer of sensitive covered data to third parties without obtaining effective consumer consent is prohibited. Data of minors under 17 is treated as sensitive data.

The law would prohibit the use of sensitive data for discriminatory purposes against consumers (extended civil rights protection).

It would grant consumers the right to refuse the use of algorithms for decision-making. The use of "dark patterns" to deceive users is also prohibited. It introduces a three-tier enforcement system: the Federal Trade Commission (FTC), state attorneys general (or their chief consumer protection officers), and consumers could enforce law violations.

It thus establishes strict enforcement mechanisms to hold violators accountable and introduces a private right of action for individuals who may sue involved companies if they are harmed by a data breach.

This right allows for the enforcement of various provisions and the seeking of damages, injunctions, declaratory judgments, and "reasonable" legal and litigation costs.