And FTC guidance is critical for data security.
Scott Sinder et al. 24, represents trade associations and companies, as both a legislative advocate and a litigator, on a wide range of issues in state and federal trial and appellate courts, 05/13/2024, “American Privacy Rights Act: An Overview of the Landmark Privacy Legislation Being Considered by Congress,” https://www.steptoe.com/en/news-publications/american-privacy-rights-act-an-overview-of-the-landmark-privacy-legislation-being-considered-by-congress.html, avr
Under APRA, similar to CCPA/CPRA, covered entities must establish, implement, and maintain data security practices that are appropriate to the entity's size, the nature and scope of the entity's data practices, the volume, nature, and sensitivity of the data, and state-of-the-art administrative, technical, and physical safeguards. The legislation provides a list of specific practices that covered entities must follow. For example, covered entities must routinely identify and assess any reasonably foreseeable risk to each system maintained by the covered entity and must take preventative and corrective action to mitigate any such risk.
Enforcement and Penalties
The draft legislation provides for several enforcement mechanisms, including by the FTC, state attorneys general, and a private right of action. The FTC is directed to establish, within one year after APRA’s enactment, a new bureau to carry out its authority under APRA. APRA also authorizes enforcement by state attorneys general, chief consumer protection officers, and other state officers in federal district court.
Notably, APRA allows individuals to initiate a civil action against an entity that violates their rights. In such cases, individuals may recover actual damages, injunctive relief, declaratory relief, and reasonable attorney fees and costs. Individuals also retain the right to sue under Illinois's Biometric Information Privacy Act, and Genetic Information Act, and the California Privacy Rights Act. The legislation provides entities with a 30-day period to cure prior to lawsuits seeking injunctive relief and a 30-day notice period prior to lawsuits seeking actual damages. However, the 30-day cure and notice periods do not apply in actions involving a substantial privacy harm.
APRA's private right of action goes well beyond current privacy laws in the United States, whether the GLBA or nearly all state privacy statutes that do not permit private actions. Indeed, APRA's private right of action surpasses the private right of actions in CCPA and CPRA, each of which only permits private actions for breaches of data security requirements.
FTC Regulations
If enacted, the FTC will be required to issue guidance on several aspects of the legislation, including compliance with due diligence requirements, compliance with opt-out rights for consequential decisions, the scope of the preemption provisions, and the breadth of the data disclosures necessary for required short-form privacy notices.