United States of America: Announced American Privacy Rights Act including data protection regulation

On 7 April 2024, the Chairs of the House Committee on Energy and Commerce and Senate Committee on Commerce, Science and Transportation published the American Privacy Rights Act of 2024. The Act aims to establish consumer data privacy rights and standards regarding the collection and processing of sensitive personal data. The consumers would have the right to access, correct, delete, and export their data. Furthermore, the Act would introduce a transparency obligation regarding the collection of data and would require entities to comply with data minimisation principles, requiring data collection and usage to be necessary and limited to specific purposes and prohibiting the transfer of sensitive data without explicit consumer consent. In addition, the Act includes measures to protect consumers from discriminatory practices and would require entities to offer consumers the option to opt-out of the use of algorithms for consequential decisions. Finally, the Act includes additional measures for the entities classified as large data holders, including publishing information on privacy policies from the last 10 years, reporting metrics related to consumer requests, appointing privacy and a data security office and conducting annual controls internal controls and impact assessments.