{"id":4069,"date":"2022-08-31T05:44:44","date_gmt":"2022-08-31T05:44:44","guid":{"rendered":"https:\/\/2024.thenexus.today\/index.php\/2022\/08\/31\/adppa-data-minimization\/"},"modified":"2022-08-31T05:44:44","modified_gmt":"2022-08-31T05:44:44","slug":"adppa-data-minimization","status":"publish","type":"post","link":"https:\/\/2024.thenexus.today\/index.php\/2022\/08\/31\/adppa-data-minimization\/","title":{"rendered":"ADPPA’s data minimization and duty of loyalty: a deep dive"},"content":{"rendered":"

One of ADPPA’s strong points is its focus on data minimization<\/em>. \u00a0This principle has been a bedrock of privacy law as one of the Fair Information Practices since the 1970s, and is also included in Europe\u2019s GDPR and California\u2019s CPRA.<\/p>\n

ADPPA complements data minimization with a \u201cduty of loyalty\u201d, a powerful and relatively-recent innovation in privacy law. \u00a0As privacy scholars Neil Richards and Woodrow Herzog write in We\u2019re so close to getting data loyalty right<\/a><\/p>\n

Done correctly, duties of loyalty would change a company\u2019s business incentives away from manipulative and exploitative practices toward long-term, sustainable and mutually beneficial information relationships between people and companies<\/p><\/blockquote>\n

Of course, as widely-respected privacy scholar Prof. Daniel Solove says in \u00a0Further Thoughts on ADPPA, the Federal Comprehensive Privacy Bill<\/a>, “many parts of privacy laws have pretty-sounding rhetoric but ultimately are not any deeper\u201d. Virginia\u2019s and Utah\u2019s privacy laws \u2013 which even industry lobbyists describe as \u201cweak and loophole-ridden\u201d \u2013 are also based on data minimization principles, but the wording is so weak that there\u2019s virtually no protection.<\/p>\n

So let\u2019s dive more deeply into these relevant sections of ADPPA. \u00a0I\u2019ve included some of the key language from the current version of bill;, but if you want to follow along in the text, section numbers (\u00a7) refer to the July 19 ADPPA version<\/a> as amended by the six amendments<\/a> that passed. The redlined version from IAPP and Future of Privacy Forum<\/a>, including all the amendments and highlighting changes from the subcommittee’s version, is also very useful.<\/p>\n

Data minimization and permissible purposes<\/h2>\n

A covered entity may not collect, process, or transfer covered data unless the collection, processing, or transfer is limited to what is reasonably necessary and proportionate to\u2014<\/p>\n

(1) provide, or maintain a specific product or service requested by the individual to whom the data pertains; or<\/p>\n

(2) effect a purpose expressly permitted under subsection (b).<\/p>\n

\u2013 American Data Privacy and Protection Act (ADPPA), \u00a7101(a):<\/p><\/blockquote>\n

ADPPA\u2019s data minimization rules apply to everything that the businesses and non-profits it regulates do to any data that it covers. There are actually some big exemptions hidden behind these definitions,* but put that to the side for now and focus on the entities and data that it does cover.<\/p>\n

Once a company collects data for specific purpose, ADPPA’s data minimization rules say they can only process or transfer it it for that purpose and for the other permissible purposes<\/em> listed in \u00a7101(b). \u00a0<\/p>\n

Why have any <\/em>permissible purposes beyond providing the individual with the product or service the individual requests? \u00a0Well, imagine if companies had to get consent from everybody before each time they analyze email to see whether it should go into a spam folder. \u00a0Spammers wouldn\u2019t give consent, so good luck with spam detection. \u00a0And for the rest of us, you can imagine how this would be even more annoying than cookie dialogs.<\/p>\n

We\u2019ll go through the specific permissible purposes below, but first let\u2019s talk about how the ADPPA\u2019s \u201cduty of loyalty\u201d interacts with the data minimization requirements.<\/p>\n

\u201cDuty of loyalty\u201d<\/h2>\n

As Richards and Herzog discuss, ADPPA\u2019s \u201cduty of loyalty\u201d (\u00a7102) only covers data minimization \u2013 just one piece of what a duty of loyalty really needs to cover<\/a>, and the reason I put air quotes around it. Still, it\u2019s certainly an important aspect, and ADPPA\u2019s \u00a0\u201cduty of loyalty\u201d adds some significant protections for sensitive data <\/em>(defined in \u00a72(28))<\/p>\n

Sensitive data is a fairly broad category under ADPPA, including health data; biometric and genetic information; \u201cprecise geolocation information\u201d; credit card numbers and financial information; drivers license and passport numbers; photos, videos, and private communications including emails, voicemails and texts (unless they\u2019re on employer-issued machines); and quite a few other categories. There are some important exceptions; for example, sex, sexual orientation, and immigration status aren\u2019t considered sensitive data, and as Californians for Consumer Privacy discusses<\/a> the definition of \u201cprecise geolocation information\u201d (\u00a72(24)) excludes location information from surveillance cameras and photos people take. \u00a0Once again, though, let\u2019s put these aside for now.<\/p>\n

For sensitive data, ADPPA\u2019s \u201cduty of loyalty\u201d adds several important protections to the basic data minimization rules:<\/p>\n