Achieved Compliance Analyzes Draft Data Privacy Legislation

Written by Achieved Compliance

Currently, a drafted piece of data privacy legislation called the American Data Privacy and Protection Act ( ADPPA) is going through the US Congress. After some research and discussion, we analyzed what's in the proposed bill.

The bill would:

  • ‍ Provide for a data minimization requirement. The FTC would determine which types of data collection constitute "reasonably necessary, proportionate, and limited."
  • Enable Americans to access their data, request its deletion or correction, and export it elsewhere.
  • Prohibit companies from serving targeted ads to children under 16.
  • Limit how companies can process and share certain sensitive data.
  • Require large data holders to conduct annual civil rights assessments on their algorithms’ impacts and report these to the FTC.

‍ There are two aspects of the draft that will likely prove particularly controversial:

  • ‍ A private right action would take effect four years after enacting the law.
  • It allows for the pre-emption of state privacy laws.

The Bill is unlikely to pass this year. However, it will probably serve as a template for legislation going forward. Bipartisan interest in the bill is unusual in a famously divided Congress, and an indication that this is a serious bill. The House Energy and Commerce Committee will hold a hearing on this data privacy legislation issue on June 14.

If you have any questions, please reach out for a free consultation here.

PRIVACY BLOG

New Fine Highlights the Necessity of EU-GDPR Article 27 Representation for US Companies](/content/blog/article-27-representation/index.html)

The Data Use and Access Act 2025 (DUAA) Key Changes to Data Protection Law](/content/blog/the-data-use-and-access-act-2025-duaa-key-changes-to-data-protection-law/index.html)

Privacy Compliance: Why Software Solutions Could Put You at Risk](/content/blog/privacy-compliance-why-software-solutions-could-put-you-at-risk/index.html)

The Troubling Cuts to Medical Research](/content/blog/the-troubling-cuts-to-medical-research/index.html)

ARE YOU CREATING PRIVACY ISSUES WITH AI?](/content/blog/are-you-creating-privacy-issues-with-ai/index.html)

European Commission Publishes New Standard Contractual Clauses and Guidance on Implementation](/content/blog/standard-contractual-clauses/index.html)

Dutch Data Protection Authority Fines Uber for Storing Personal Data in U.S. Without Required Protections](/content/blog/dutch-data-protection-authority-fines-uber-for-storing-personal-data-in-u-s-without-required-protections/index.html)

New York State Attorney General’s Office Issues Guidance on Tracking Technologies and Privacy](/content/blog/new-york-state-attorney-generals-office-issues-guidance-on-tracking-technologies-and-privacy/index.html)

Spanish Data Authority Fines Data Processor for Failure to Assess and Address Risks of Security Breach](/content/blog/spanish-data-authority-fines-data-processor-for-failure-to-assess-and-address-risks-of-security-breach/index.html)

Connecticut Attorney General’s Office Releases Report on New Data Privacy Law](/content/blog/connecticut-attorney-generals-office-releases-report-on-new-data-privacy-law/index.html)

Data Protection Commissioner of Ireland (DPC) Investigation Focuses on Location Data The DPC recently wrote to inform data controllers who may be in receipt of or sharing location data that it has initiated the regulatory assessment. It also notified organizations linked to those whose activities are the subject of the DPC assessment and stressed that failure to meet statutory obligations pertaining to processing of location data will result in regulatory action. read more](/content/blog/data-protection-commissioner-of-ireland-dpc-investigation-focuses-on-location-data/index.html)