United States of America: Announced American Data Privacy and Protection Act discussion draft including data protection measures

On 3 June 2022, bipartisan members of the House Committee on Energy and Commerce and the Senate Committee on Commerce, Science, and Transportation released a discussion draft of the American Data Privacy and Protection Act, a data privacy and security framework with bipartisan legislative support. The draft contains extensive rules on data protection. It begins by laying out basic definitions, such as 'covered entities', 'covered data', and 'sensitive covered data'. It prohibits unnecessary data collection and restricts certain harmful data practices. Further, covered entities are required to implement data collection, processing, and transfer policies that take privacy risks into account, and to provide information about these policies to individuals in a transparent manner. The draft also gives individuals rights to access, correct, delete, and portability of their data, as well as a right to being provided with a means to consent or object to new uses of their data. Stricter data protection rules apply to children and minors, including prohibitions on targeted advertising to individuals under the age of 17. Additionally, the Act prohibits covered entities from collecting, processing, or transferring data in a way which discriminates or makes the equal enjoyment of goods or services unavailable on the basis of race, colour, religion, national origin, gender, sexual orientation, or disability. The prohibition does not apply where data is processed for the purpose of diversifying an applicant, participant, or consumer pool. Finally, the draft specifies that it will preempt the States privacy laws with the exemption of the ones regulating facial recognition technologies, electronic surveillance, wiretapping, health information or the laws that govern the privacy rights of employees and students.