Are we watching the forest and not noticing the trees? The bipartisan American Data Privacy and Protection Act Discussion Draft has so much in it that most everyone is trying to grasp the issues, with most of the discussion on preemption and a private right of action. But, in doing that, are we failing to focus on one other?
And perhaps, the even more impactful, hidden major issue – that opt-in would be required before a company could process, collect, or transfer sensitive data?
Why is this an impactful issue? Because the bill defines sensitive covered data incredibly broadly, way beyond what you would expect, and grants the FTC rulemaking authority to broaden what is defined as sensitive even further.
An opt-in would be required for a marketer to use not just what we would usually consider sensitive data, but also, under this broad definition, online activities (over time or across third-party websites), media viewing history, private communications (emails, chat), and geolocation. (As the draft bill requires providing an opt-out for targeted advertising, there is an arguable inconsistency. However, the intent is clearly to provide an opt-in for information identifying an individual’s online activities.)
Is this not effectively…
