The American Data Privacy and Protection Act (ADPPA) is a proposed federal privacy law that would preempt most state privacy laws. Proponents of the ADPPA in the privacy community have made it clear that their analysis shows that ADPPA is so much better than the California Privacy Rights Act (CPRA) that it is perfectly OK to preempt the CPRA (and effectively kill the “California Effect” of setting consumer protection standards for the nation vis a vis privacy) as part of the “grand bargain” to get a deal done and the US to finally have a national privacy law.
But is ADPPA really better than CPRA? A new analysis says “not so fast” and that CPRA is still functionally better.
Probably the most quoted analysis stating that ADPPA is superior to CPRA is the deep dive is by the Electronic Privacy Information Center (EPIC) who did their breakdown here.
In this review EPIC looks at ADPPA vs. CPRA in 24 different categories (e.g., Prohibits discriminatory uses of data, Algorithmic Impact Assessments, Automated Decision Making Rights, etc.), and given that it appears they equally weight each category, one can score things this way:
ADPPA is better in 9 areas, CPRA is better in 4, and functionally the same in 11.
So ADPPA “wins” in their analysis.
But the main proponent of CPRA — Californians for Consumer Privacy (CCP) — has taken a look at EPIC’s analysis, and published its detailed analysis.
Suffice to say, the CCP added some additional categories (e.g., Profiling and Covered Data). Their tally is:
ADPPA is better in 3 areas, CPRA in 21, and functionally the same in 7.
It might be nice to have EPIC and CCP have a debate on this, which I would gladly pay for.
But to me, it does not matter if ADPPA or CPRA is 5 or 10% better than each other. The issue I am stuck on is preemption.
California has always led when it comes to consumer protection — aka the “California Effect” — and I am very concerned that neutering California is not a good thing in the long run for not only citizens in California but in the entire US. I agree with Justice Brandeis that you need states being the laboratories of experimentation when it comes to consumer protection. And basically all our other privacy-related federal bills did not preempt the states. Plus federal privacy laws have a history of not getting updated, which is bad in this fast-moving area of technology.
I guess I am still stuck on this analogy: say you are an environmentalist. Hypothetically, would you agree to a national fuel emission standard of say 30 MPG with the following scenarios: (a) most states and the federal government currently have it at most 22 MPG but California has it at 27, (b) but as part of the deal to set it at 30 MPG it would mean that no state can ever set its own again (e.g., California — that has historically set the standard that automakers follow — could no longer set fuel emission standards), and © knowing full well that the 30 MPG may not get updated for 30 years. I think most environmentalists would want the California Effect to continue.
