The American Privacy Rights Act (APRA) of 2024 proposes a landmark shift in the way personal data is collected, used, and protected in the United States. This bipartisan legislation aims to establish a single, national standard for data privacy, replacing the current patchwork of state-level regulations.

Core Principles: Data Minimization and Individual Control

The APRA emphasizes data minimization as a core principle. Businesses can only collect, process, and transfer data that is demonstrably necessary for their services or explicitly permitted by the Act. This approach aims to limit the data footprint of businesses, reducing the potential for misuse or breaches.

The Act grants individuals a robust set of rights regarding their data. Consumers have the right to access their data held by businesses, understand how it’s used, and request its correction or deletion. Additionally, the APRA establishes clear and unambiguous consent requirements. Businesses must obtain opt-in consent for the collection and use of personal data, particularly for sensitive categories like health information or geolocation data.

Transparency and Security

Transparency is another key pillar of the APRA. Businesses are required to provide consumers with clear and accessible privacy notices. These notices detail what data is collected, how it’s used, and with whom it’s shared. This empowers consumers to make informed decisions about their data.

Data security remains a major concern in the digital age. The APRA mandates that businesses implement reasonable data security measures to protect covered data from unauthorized access, disclosure, alteration, or destruction. This includes safeguards against cyberattacks and data breaches.

Additional Features

The Act goes beyond basic data control by offering functionalities that enhance consumer empowerment:

· Data portability: Individuals have the right to receive their data in a transferable format, allowing them to easily switch between service providers.

· Right to opt-out of targeted advertising: Consumers can choose not to have their data used for profiling and targeted advertising.

· Universal opt-out mechanisms: The APRA encourages the development of standardized opt-out mechanisms across browsers and devices, simplifying consumer control over data sharing.

· Data broker restrictions: The Act imposes limitations on how data brokers can collect, use, and sell personal information.

· Private Right of Action: To enforce the rights given under the Act, the APRA includes a private right of action for individuals. This means that if a company violates data privacy provisions, affected individuals can take legal action against the company. The legislation provides a mechanism for holding violators accountable and seeking remedies.

Conclusion

The APRA represents a significant step towards establishing a comprehensive data privacy framework in the United States. By empowering consumers with control over their personal information and holding businesses accountable for its use, the Act has the potential to usher in a new era of data privacy in the digital age.

If you’re an organization dealing with copious amounts of data, do visit www.tsaaro.com.

---

Privacy News

1. Shanghai To Remove Mandate Of Facial Recognition For Individuals Presenting Identification

According to Yicai Global, hotels in Shanghai will no longer mandate facial scans for guests who present identification. Zhao Huanyan, a senior economist at Magnificent International Hotel, mentioned that discontinuing this requirement could boost tourism. “While this procedure was justifiable under the stringent security measures of the Covid-19 pandemic, it now seems excessive as the tourism sector recovers, only serving to annoy visitors,” Huanyan explained.

https://www.yicaiglobal.com/news/shanghai-hotels-stop-scanning-faces-at-check-in-should-boost-inbound-tourism-insiders-say

2. New Zealand Department Of Internal Affairs Suggests Elimination Of Privacy And Information Security Personnel As A Cost Cutting Measure

RNZ has reported that the New Zealand Department of Internal Affairs has suggested that the government eliminate roles related to privacy and information security as a cost-cutting measure. Duane Leo, the National Secretary of the Public Service Association, criticized this proposal, stating that these positions are crucial for protecting the public’s data. “Given the increasing threats of cybersecurity, the growing use of online public services, and the emerging risks associated with artificial intelligence, the government should be increasing its investment in these areas, not cutting back,” Leo argued.

https://www.rnz.co.nz/news/national/515677/dia-proposes-cutting-eight-roles-relating-to-information-security-union-says

3. South Korean PIPC Imposed Fine On Six Companies

South Korea’s Personal Information Protection Committee imposed fines on six companies, totaling KRW196.99 million, for purported violations of the Personal Information Protection Act. Each business was fined KRW47.1 million for allegedly neglecting to establish adequate data security measures.

https://iapp.org/news/a/south-koreas-pipc-issues-fines-to-businesses-for-alleged-pipa-violations

4. Hong-Kong’s Privacy Commissioner publishes report on data breach

According to the South China Morning Post, Hong Kong’s Privacy Commissioner for Personal Data has published a report on a data breach involving the Consumer Council. The report revealed that the Consumer Council failed to use multifactor authentication and did not report the breach promptly. In response, the Consumer Council stated that it is updating its IT policies and procedures and is hiring a managed detection and response service provider to better protect against cyber threats.

https://www.scmp.com/news/hong-kong/law-and-crime/article/3261177/cyberattack-hong-kong-consumer-watchdog-due-lack-security-measures-report

5. Israeli Ministry Of Justice Proposes Legislation To Permit Privacy Violations.

Israel’s Ministry of Justice has proposed legislation that would permit privacy violations to be grounds for class-action lawsuits. The bill seeks to broaden the scope for initiating class actions for privacy breaches as defined under Section 2 of the Protection of Privacy Law, with the goal of fostering legitimate and equitable legal actions.

https://iapp.org/news/a/israel-introduces-law-on-class-action-privacy-infractions