The American Privacy Rights Act of 2024: Could this framework become the data privacy panacea?

Why it matters

The APRA bill, or the American Privacy Rights Act, looks to address ongoing concerns related to data privacy in the digital era, proposing an approach to empower consumers to have greater control over their online data and personal information. The act, if passed, would:

• Provide all Americans with a basic right to digital privacy
• Create a national law regulating how companies can use personal data
• Limit companies’ ability to track, predict and manipulate people’s behaviors for profit without their knowledge and consent
• Establish a uniform national standard for data privacy and security in the United States

What’s more, the act will eliminate the patchwork of state laws that currently exist and provide a mechanism for the Federal Trade Commission and state authorities to enforce the law. The proposed act also creates a method to determine fines that are based upon the nature, severity and duration of a violation. 

What they say

Saying “Americans deserve the right to control their data,” Lawmakers Sen. Maria Cantwell (D-Wash.) and Rep. Cathy McMorris Rodgers (R-Wash.) introduced a bipartisan bill that would set “clear, national data privacy rights and protections for Americans.”

McMorris Rodgers says:

“This landmark legislation gives Americans the right to control where their information goes and who can sell it. It reins in Big Tech by prohibiting them from tracking, predicting, and manipulating people’s behaviors for profit without their knowledge and consent. Americans overwhelmingly want these rights.”

Cantwell says:

“A federal data privacy law must do two things: it must make privacy a consumer right, and it must give consumers the ability to enforce that right… our bill does just that. This bipartisan agreement is the protections Americans deserve in the Information Age.”

What we say

Protiviti Senior Managing Director Tom Moore comments:

“This demonstrates the increasing importance of data privacy to consumers in their daily lives and the need to address the patchwork of state privacy laws that have emerged in the U.S. For businesses who want to use data responsibly to reach and serve those consumers while innovating and improving their operations, it’s critical they engage with their trusted advisers on the implications of this proposal. While this bill may be reworked, modified, or dropped, organisations should continually assess not only on their privacy compliance program but also on their business models and desire to build sustainable relationships based on trust with consumers.”

The bottom line

The announcement is seen as reinvigorating the debate over how data privacy should be regulated in the U.S. Although the bipartisan and bicameral approach taken by Cantwell and McMorris Rodgers is constructive to seeing federal legislation enacted, there is a long way to go and not much time until the November elections. Many interested parties will be weighing in over the months ahead including consumer and civil rights organisations, academics, industry and trade associations as well as other legislators at both the state and federal level. While it is too early to tell whether this effort will lead to passage of a U.S.-wide data privacy law in this or future sessions, and an effective date for compliance may be years away, if at all, companies and their boards should pay close attention now to how this current process will impact their enterprise.