In this era of digital advancements, safeguarding our personal data has become increasingly crucial, as it holds greater value than ever before. This is where the American Data Privacy and Protection Act (ADPPA) comes into play. Let’s dive into what ADPPA means, why it matters, and how you can ensure compliance.

Understanding The American Data Privacy and Protection Act (ADPPA)

Countries worldwide are actively formulating data protection laws, underscoring the growing significance of safeguarding information. Despite being a hub of technological innovation, the United States lacks a federal data protection law, with some states like California, Utah, Colorado, Virginia, and Connecticut enacting their own. However, the landscape might change with the proposed American Data Privacy and Protection Act (ADPPA), presented by House Energy and Commerce Committee Chair Rep. Frank Pallone, Ranking Member Rep. Cathy McMorris Rodgers, and Sen. Roger Wicker. This bipartisan proposal aims to unify data protection regulations across the U.S., preempting state laws.

The ADPPA addresses consumer rights, outlines organizations’ responsibilities, and calls for FTC guidance within a year of enactment. This comprehensive initiative marks a pivotal step in establishing federal privacy legislation. The American Data Privacy and Protection Act (ADPPA) is a comprehensive legislation aimed at safeguarding the personal data of American citizens. It sets strict guidelines for how organizations collect, store, and handle individuals’ information, ensuring transparency and accountability in the digital realm.

See BigID in Action

Why ADPPA Matters

According to the American Data Privacy and Protection Act (ADPPA), individuals would have the right to be informed about the usage and processors of their personal data. Furthermore, they would possess the right to update and download their user data. During the initial four years following the Act’s enactment, individuals could file lawsuits against organizations violating its regulations, provided they give a 60-day notice to the Federal Trade Commission and their state’s Attorney General.

Additionally, the ADPPA addresses the complex issue of data transfers across borders. Companies handling American data internationally must adhere to stringent data protection standards, guaranteeing that your personal information is secure no matter where it travels.

Download the solution brief.

Who Must Comply

The proposed American Data Privacy and Protection Act (ADPPA) delineates its jurisdiction and data coverage in clear terms:

Material Scope: ADPPA defines “covered data” as information reasonably linkable to an individual or a device associated with an individual, including unique identifiers and derived data. Exclusions involve de-identified data, employee data, and publicly available information. Sensitive data, as per ADPPA, includes information identifying online activities across time or third-party platforms.

Territorial Scope: ADPPA aims to establish foundational data privacy rights, oversight mechanisms, and enforcement nationwide. A “covered entity” refers to any organization under Federal Trade Commission (FTC) jurisdiction that collects, processes, or transfers covered data. This includes nonprofits, telecommunications common carriers, and entities sharing control or branding.

Exceptions: ADPPA offers exemptions for covered entities meeting specific criteria for up to three years before the Act’s enactment. Qualifying criteria include average annual gross revenues not exceeding $41 million, annual collection or processing of covered data for fewer than 100,000 individuals, and deriving less than 50 percent of revenue from covered data transfers during any applicable year.

Any organization that collects, processes, or stores the personal data of American citizens must comply with the American Data Privacy and Protection Act (ADPPA). This includes businesses, government agencies, nonprofits, and any entity that handles individuals’ personal information.

ADDPA Consent Requirements

Under ADPPA, obtaining explicit, affirmative consent from individuals is mandatory before collecting, processing, or sharing sensitive covered data with third parties. Individuals should have accessible and straightforward options to grant or revoke their consent, using clear and user-friendly methods.

Obtaining explicit user consent is a prerequisite for organizations intending to collect, process, or transfer sensitive personal data, encompassing geolocation, genetic and biometric information, and browsing histories. Moreover, the organization must secure user consent before transferring such data to third parties. It is imperative for organizations to facilitate users with easily accessible options to revoke their consent at any given time.

Ensuring transparency, organizations should adopt a straightforward approach in collecting and managing user consent choices. In cases where a covered entity implements material changes to its privacy policy or practices, it is obligated to inform affected individuals before any further processing or transferring of previously collected data. Additionally, the entity must provide a reasonable opportunity for individuals to withdraw consent for any future data activities under the revised policy.

Accelerate Your Privacy Program

ADPPA Compliance Checklist

To ensure compliance with ADPPA, companies should:

  • Obtain explicit consent for data collection.
  • Encrypt sensitive data during storage and transmission.
  • Establish access controls and authentication measures.
  • Regularly audit and monitor data access.
  • Develop a robust incident response plan.
  • Stay informed about relevant data protection laws.

BigID’s Approach to ADPPA Compliance

BigID is the industry leading data management platform for privacy, security, and governance. Organizations looking to achieve compliance with ADPPA and other regulations can benefit from BigID’s wide range of tools to streamline their efforts:

  • Discover your data: Identify and classify all your personal and sensitive data across your entire landscape, both in the cloud and on-prem.
  • Get valuable context: Correlate relationships between data by bringing context to personal data and sensitive data.
  • Automate consent management: Automate manual fulfillment of consent governance with the Consent Governance App.
  • Manage data risk: Enable data minimization with duplicate identification, remediate sensitive or at-risk data, proactively monitor privacy risk.

To kickstart all your data privacy initiatives and achieve compliance with ADPPA— get a 1:1 demo with our experts today.