US Data Protection Act of 2021

This bill establishes the Data Protection Agency (DPA), an independent agency to regulate specified high-risk data practices and the collection, processing, and sharing of personal data. This includes the transfer of the powers and duties with respect to specified federal privacy laws from the Federal Trade Commission to the agency.

Among other functions, the agency must oversee the use of high-risk data practices, which include (1) using automated decision systems, such as machine learning; (2) profiling individuals on a large scale; (3) and processing personally identifying biometric information, such as genetic data. The agency also must prevent and remediate specified privacy harms (i.e., commercial practices that may lead to an adverse outcomes resulting from the collection, processing, or sharing of personal data).

The agency is authorized to collect fees from large data aggregators (i.e., large commercial entities that collect, use, or share the personal data). The agency also may require periodic reports and conduct periodic examinations of large data aggregators.

The bill authorizes the agency to prescribe rules, issue orders, and otherwise enforce violations of this bill and other privacy laws.

Further Reading: https://www.yalelawjournal.org/forum/dismantling-the-black-opticon

Analysis

Does the policy solution re-distribute power from mainstream institutions to impacted Black community?   

The policy solution outlined in the Data Protection Act of 2021 aims to fundamentally shift power dynamics by creating an agency tasked with safeguarding individual privacy and reducing discrimination based on protected characteristics, including race. By focusing on preventing privacy harms and ensuring fair treatment in the processing of personal data, the policy seeks to empower marginalized communities, such as the Black community, that have historically been disproportionately affected by data exploitation. This initiative not only enhances oversight of high-risk data practices but also promotes equal opportunity in economic activities by minimizing the collection of personal data for commercial purposes and enforcing federal privacy laws consistently. These efforts are crucial steps towards rebalancing control over personal information away from mainstream institutions towards a regulatory framework that prioritizes equity and accountability. Through its mandates to oversee and enforce privacy protections, the policy aims to provide meaningful redress for privacy violations and discriminatory practices, thereby empowering individuals, especially those from marginalized communities, to have greater control over their personal data. By limiting the potential for differential treatment and disparate impacts in data processing, the policy helps to level the playing field and mitigate the systemic disadvantages faced by the Black community and other vulnerable groups. This approach not only supports the redistribution of power from mainstream institutions but also fosters a more equitable digital landscape where privacy rights are upheld, and individuals are afforded fair opportunities in economic and social spheres.

Does this policy address needs impacting diverse groups within Black communities (Black femmes, Black LGBTQ+ communities, Black immigrants, people in poverty, differently abled, people impacted by justice system)? If so, how?  

Yes, the Data Protection Act of 2021 addresses the needs impacting diverse groups within Black communities in several significant ways. First, by preventing and remedying discrimination based on protected classes, including race and potentially intersecting identities like gender, sexual orientation (Black LGBTQ+ communities), and disability status (differently abled individuals), the policy aims to reduce disparities in how personal data is used and accessed. This is crucial for protecting Black femmes, Black LGBTQ+ communities, and others who may face compounded vulnerabilities due to their identities. Moreover, the policy’s objective to promote equal opportunity in economic life through fair and non-discriminatory processing of personal information directly benefits Black immigrants, people in poverty, and those impacted by the justice system. By overseeing and minimizing high-risk data practices and ensuring consistent enforcement of federal privacy laws, the policy seeks to mitigate the disproportionate impacts of data exploitation on these marginalized groups. It aims to create a regulatory environment that fosters equitable treatment and access to economic opportunities, thereby addressing systemic barriers that have historically marginalized diverse groups within Black communities.

Does this policy provide more decision-making power at the hands of Black communities?  

Yes, the Data Protection Act of 2021 aims to provide more decision-making power to Black communities by promoting fair and non-discriminatory processing of personal information. By preventing and remedying privacy harms and discrimination based on protected classes, including race, the policy seeks to empower Black communities to have more control over how their personal data is collected, used, and shared. This empowerment is crucial in ensuring that Black communities can participate more actively in decisions that affect their privacy and rights, thereby promoting greater autonomy and self-determination in digital spaces.

Does the policy undermine extractive economies like capitalism and restore community power around a local and regenerative economy/ primary production?  

The policy does not explicitly aim to undermine extractive economies like capitalism or directly restore community power around a local and regenerative economy or primary production. However, it does include measures that can indirectly contribute to these goals. By authorizing the Data Protection Agency to collect assessments, fees, or charges from large data aggregators, the policy ensures that these entities contribute financially to the Agency’s operations, reducing the economic burden on the public sector and potentially limiting the unchecked growth of large corporations. The creation of the Data Protection Civil Penalty Fund, which allocates penalties to victims of privacy violations or to educational and technological research initiatives, can help address some of the harms caused by exploitative data practices.

Additionally, the policy allows for a cy-pres approach, distributing funds to organizations whose interests align with those of the victims, potentially supporting community-focused initiatives and promoting data protection and privacy. These elements collectively can contribute to a more equitable economic environment by holding large corporations accountable and redistributing resources in a manner that benefits consumers and communities.

Does the policy repair past harm and uphold civil and human rights, health and environmental protections? 

Yes. The DPA would establish an Office of Civil Rights to ensure that personal data collection, use, and sharing are fair, equitable, and non-discriminatory. It would develop data processing practices that enhance access to housing, employment, credit, insurance, education, healthcare, and other commercial activities. The office would collaborate with civil rights advocates, privacy organizations, and data aggregators to promote compliance with federal privacy laws. It also would engage with impacted communities and consumers and provides annual reports to Congress on the Agency’s civil rights efforts. The Agency’s Research Unit would examines the collection and use of personal data, including automated decision systems. Additionally, the unit would identify and report on unfair, deceptive, or discriminatory outcomes, especially those impacting protected classes.