The American Data Privacy and Protection Act would mandate data minimization and let Americans opt out of targeted ads while preempting many state privacy laws.
A new bipartisan privacy bill offers a compromise along the lines of what many tech companies and even some privacy advocates have said we need to get something—anything—out of Congress and into statute: federal privacy protection that preempts most state privacy laws. The American Data Privacy and Protection Act, announced Friday by Reps. Frank Pallone, Jr. (D-N. J. ), Cathy McMorris Rodgers (R-Wash.), and Sen. Roger Wicker, (R-Miss.), remixes many existing concepts and proposals; policy ingredients that other legislators have yet to turn into a recipe that can emerge from the Congressional kitchen. As covered the bill’s 64-page draft (PDF) and 10-page outline (PDF), it would would require most companies to comply with data-minimization guidelines. That means they can’t collect, process, and hoard a wide variety of personal data—from financial details to stored communications to their activity at social and entertainment sites—for reasons unrelated to providing the product or service they offer. The bill would apply higher standards to such especially sensitive items as Social Security numbers, geolocation records, biometric information, browsing history, and genetic data, in most cases requiring a person’s upfront permission.
