Data Protection Act of 2024

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Defunct
• Most recent activity date: 2025-01-03

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unfair discrimination and misrepresentation
• Unequal performance across groups
• Compromise of privacy
• Governance failure
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• AI system security vulnerabilities
• False or misleading information
• Disinformation, surveillance, and influence at scale
• Fraud, scams, and targeted manipulation
• Overreliance and unsafe use
• Loss of human agency and autonomy
• Power centralization and unfair distribution
• Increased inequality and decline in employment
• Environmental harm
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 10-12 subdomains, with strong focus on discrimination and bias (1.1, 1.3), privacy compromise (2.1), AI system security (2.2), misinformation (3.1), malicious actors (4.1, 4.3), overreliance (5.1), power centralization (6.1), governance (6.5), and lack of robustness/transparency (7.3, 7.4). Coverage is concentrated in discrimination prevention, privacy protection, and AI system oversight domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information
• Finance & Insurance
• Professional & Technical Services
• Educational Services
• Health Care & Social Assistance
• Public Administration (excl. National Security)

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Agriculture, Mining, Construction & Manufacturing
• Trade, Transportation & Utilities
• Real Estate, Rental & Leasing
• Scientific Research & Development Services
• Management, Administrative & Support Services
• Arts, Entertainment & Recreation
• Accommodation, Food & Other Services
• National Security

All other sectors had no coverage in this document.

Sectors Summary

The Act governs AI use across virtually all economic sectors through its broad regulation of 'data aggregators' and 'automated decision systems'. It explicitly addresses high-risk data practices in Finance and Insurance, Health Care, Educational Services, Professional Services, and Public Administration. The cross-sectoral approach regulates any entity collecting personal data above specified thresholds, making it applicable to most industries.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal statute enacted by Congress establishing a regulatory agency with enforcement powers, mandatory compliance requirements, civil penalties, and judicial enforcement mechanisms.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The document is a federal bill proposed by Congress, as indicated by the enacting clause and legislative format. It establishes a new federal regulatory agency.

Target

• Entity Types: AI_Developer, AI_Deployer, AI_Infrastructure_Provider
• Summary: The Act explicitly targets 'data aggregators' and 'service providers' that collect, process, or share personal data. These entities include those developing and deploying AI systems (automated decision systems) and managing data infrastructure.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: The Act establishes the Data Protection Agency as the primary enforcement body with comprehensive powers including rulemaking, supervision, investigation, and civil enforcement. It also preserves enforcement authority for state attorneys general and coordinates with other federal agencies.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: The Act establishes comprehensive monitoring mechanisms through the Agency's supervisory powers, dedicated research and civil rights offices, complaint tracking systems, and mandatory reporting to Congress.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily focuses on the Deploy and Operate and Monitor stages, with significant coverage of Verify and Validate through mandatory risk assessments and impact evaluations. It addresses the entire lifecycle of AI systems (automated decision systems) through comprehensive oversight requirements, but emphasizes post-deployment monitoring, ongoing compliance, and ex-ante/ex-post evaluation processes.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems

Technical Scope Summary

The document explicitly covers AI systems through its definition and regulation of 'automated decision systems'. It does not use terms like frontier AI, general purpose AI, foundation models, or generative AI. It does not specify compute thresholds or distinguish between open-weight and closed models. The focus is on automated decision systems broadly, regardless of their specific AI architecture or capability level.