Illustration: Annelise Capossela/Axios
The House Energy and Commerce Committee began circulating a new version of the American Privacy Rights Act last week ahead of a Thursday markup that we previously reported on.
Why it matters: The latest version, per copies seen by Axios, cuts out a section on AI, algorithms and civil rights — meaning it no longer includes a prohibition on the collection and use of data that could potentially discriminate or violate someone's civil rights.
- The provision that would have required impact assessments and design evaluations for algorithms was also scrapped.
Here's a look at some of the other key differences.
On preemption of state laws, a new section states that individual laws around online protection of children and teens can override APRA if they go further than it.
- Overall, preemption is reserved for laws that look like APRA; otherwise, states can go further if they want.
For a private right of action, the latest version of APRA allows it against "covered entities and service providers" rather than just "entities," with a longer time allowed for "curing" violations.
Other changes include:
- New exemptions for medical research address concerns with the narrow scope of the data minimization standard in previous drafts.
- On targeted advertising, email marketing is more permissible, but strict data minimization is still required for targeted advertising campaigns, with a continued prohibition on use of sensitive data.
- Covered entities and service providers must show "reasonable care" when transferring data to third parties, which, lobbyists tell Axios, could make all sorts of businesses and nonprofits vulnerable to lawsuits.
What they're saying: The new version removes data minimization rules, protections for kids, advertising limits and rights to sue for personal data collected and used solely on an individual's device.
- David Brody of the Lawyers' Committee called the exemption of data on a person's device a "massive loophole" that will allow tech companies to do "almost anything they want" with data that stays on a personal device.
- "As AI and computing become more powerful, allowing more processing to occur on a device, this loophole will grow," Brody said in a statement.
Between the lines: Cutting the algorithm part may have served to satisfy House Majority Leader Steve Scalise, who doesn't want anything that could constitute AI regulation in the bill.
- Though preemption has been finessed in this version and the private right of action was made a tiny bit narrower, they're still in the bill — something GOP leadership is sure not to like.
What's next: The bill will be formally introduced ahead of the markup, E&C spokesperson Sean Kelly said.
