The Commerce and Energy Committee’s ADPPA Amendment is Out.

The proposed American Data Privacy and Protection Act is getting a facelift.

Here are some key changes:

Disclosure and consent:

Disclosure for getting affirmative consent can be procured either through the primary medium used to offer the covered entity’s product or service, or only if the product or service is not offered in a medium that permits the making of the request, another medium regularly used in conjunction with the covered entity’s product or service.Disclosure for getting affirmative consent has to be for each processing purpose (Hi GDPR enforcement cases).Same prominence and number of steps for revoking consent as for giving it (Hi CNIL).


You can be a service provider of a government entity.Service providers must establish practices to delete or return covered data to a covered entity as requested at the end of the provision of services unless retention of the covered data is required by law.Tiered definition of “knowledge” with more strict requirements for larger entities.Additional requirements for large data holders metrics reporting.New provisions of “covered high impact social media company” with 3,000,000,000 or more in annual revenue or 300,000,000 monthly active users.Entities within a group (affiliates) that share information where such sharing is reasonably expected by the individual will not be deemed third parties to each other (Potential relief from intra group “sale” scenarios).

Scope of Personal Information:

Deidentification: (1) includes not being able to link to a device that identifies or is linked or linkable to an individual; (2) new requirements to flow deidentification

Read more

Explore the site

More from the blog

Latest News