American Privacy Rights Act of 2024, Sec. 114-5

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Defunct
• Most recent activity date: 2025-01-03

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Compromise of privacy
• Governance failure

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• AI system security vulnerabilities
• Competitive dynamics

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal coverage of risk domains, primarily addressing privacy compromise (2.1) and security vulnerabilities (2.2) through privacy-enhancing technologies. It does not substantially address most AI-specific risks, focusing instead on data privacy and security governance mechanisms.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Public Administration (excl. National Security)

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Agriculture, Mining, Construction & Manufacturing
• Trade, Transportation & Utilities
• Information
• Finance & Insurance
• Real Estate, Rental & Leasing
• Professional & Technical Services
• Scientific Research & Development Services
• Management, Administrative & Support Services
• Educational Services
• Health Care & Social Assistance
• Arts, Entertainment & Recreation
• Accommodation, Food & Other Services

All other sectors had no coverage in this document.

Sectors Summary

This document governs all sectors that handle covered data, as it applies broadly to 'covered entities' without sector-specific limitations. The pilot program for privacy-enhancing technologies is sector-agnostic and available to any entity that collects, processes, or transfers covered data across all economic sectors.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal statute enacted by the United States Congress with mandatory compliance requirements, enforcement mechanisms through the Federal Trade Commission, civil penalties, and ongoing audit requirements for covered entities.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress; Committee on Energy and Commerce of the House of Representatives; Committee on Commerce, Science, and Transportation of the Senate
• Summary: The document is a section of the American Privacy Rights Act of 2024, which is federal legislation proposed and enacted by the United States Congress. The congressional committees are referenced as recipients of reports and briefings.

Target

• Entity Types: AI_Developer, AI_Deployer
• Entities: covered entities
• Summary: The document applies to 'covered entities' that collect, process, or transfer covered data and wish to participate in the privacy-enhancing technology pilot program. These entities must demonstrate compliance with data security practices and maintain use of privacy-enhancing technologies.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Federal Trade Commission (Commission); Attorney General of the United States
• Summary: The Federal Trade Commission is designated as the primary enforcement body with authority to establish the pilot program, audit covered entities, withdraw approval for non-compliance, and impose penalties. The Attorney General may also bring enforcement actions on behalf of the Commission.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Federal Trade Commission (Commission); Comptroller General of the United States; Secretary of Commerce
• Summary: The Federal Trade Commission conducts ongoing audits of pilot program participants. The Comptroller General is required to conduct a study assessing the pilot program's progress and effectiveness. The Secretary of Commerce is consulted on public and private sector engagement.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily addresses the Deploy and Operate and Monitor stages of the AI lifecycle through its focus on implementing privacy-enhancing technologies in operational systems and establishing ongoing audit mechanisms. It also covers aspects of Plan and Design through the petition process requiring demonstration of security practices.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

No technical scope terms identified.

Technical Scope Summary

The document does not explicitly mention AI models, AI systems, or any specific categories of AI (frontier, general purpose, task-specific, foundation models, generative, or predictive). It focuses on privacy-enhancing technologies as technical solutions for data security. There is no mention of compute thresholds or open-weight/open-source models.