Cybersecurity Policy Report, State AGs Speak Out Against APRA Preemption Language, (May 9, 2024)

By Jeff Williams

California Attorney General Rob Bonta (D.), along with attorneys general from 12 states and the District of Columbia and the Hawaii Office of Consumer Protection, sent a letter yesterday to congressional leaders calling for the removal of language in the draft American Privacy Rights Act (APRA) that would preempt state laws in California and other states that they said included stronger protections for consumers.

“We encourage Congress to adopt legislation that sets a federal floor, not a ceiling, for critical privacy rights and respects the important work already undertaken by states to provide strong privacy protections for our residents,” the officials from California, Hawaii, Connecticut, Delaware, the District of Columbia, Illinois, Maine, Maryland, Massachusetts, Minnesota, Nevada, New York, Oregon, Pennsylvania, and Vermont said in the letter.

The bill, unveiled last month (CPR, April 8), would, among other things, give consumers opt-out rights with respect to data collection and use; require opt-in consent for the transfer of sensitive data; and impose data security mandates on companies.

While they said they were “heartened by many provisions” in the APRA draft regarding data minimization, consent requirements, and child protections, the officials said a “federal legal framework for privacy protections must allow flexibility to keep pace with technology,” which would be “best accomplished by federal legislation that respects—and does not preempt—more rigorous and protective state laws.”

Among other concerns, the letter said that while state-level protections were already in place, or soon would be, for many consumers, Congress should ensure any privacy legislation it passed “does not undermine protections that states have already established.”

Any federal privacy framework should also “leave room for states to legislate responsively to changes on technology and data collection practices” because they are “better equipped to quickly adjust to the challenges presented by technological innovation that may elude federal oversight,” the officials said.

The officials also expressed concern that though the bill as drafted would establish an enforcement role for states, it appeared to also “substantially preempt many states’ ability to investigate” possible infractions.

News: FederalLegislation StateLegislation DataPrivacy