DATA Privacy Act

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Defunct
• Most recent activity date: 2025-01-03

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unfair discrimination and misrepresentation
• Compromise of privacy
• AI system security vulnerabilities
• Governance failure

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Unequal performance across groups
• False or misleading information
• Fraud, scams, and targeted manipulation
• Loss of human agency and autonomy
• Lack of transparency or interpretability

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document primarily addresses privacy and security risks (2.1, 2.2), with strong coverage of discrimination risks (1.1, 1.3), and governance mechanisms (6.5). It has minimal coverage of misinformation risks (3.1) and human-computer interaction risks (5.1, 5.2). The document does not address AI-specific safety failures, malicious actor risks, or socioeconomic impacts beyond privacy.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information
• Finance & Insurance
• Scientific Research & Development Services
• Health Care & Social Assistance

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Agriculture, Mining, Construction & Manufacturing
• Trade, Transportation & Utilities
• Real Estate, Rental & Leasing
• Professional & Technical Services
• Management, Administrative & Support Services
• Educational Services
• Arts, Entertainment & Recreation
• Accommodation, Food & Other Services
• Public Administration (excl. National Security)

All other sectors had no coverage in this document.

Sectors Summary

This is a cross-sectoral data privacy law that applies to any entity collecting, processing, storing, or disclosing covered data relating to 50,000 or more individuals annually. The law explicitly mentions common carriers (telecommunications), financial services (Gramm-Leach-Bliley Act), and healthcare (HIPAA), but applies broadly across all economic sectors that handle personal data.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal statute with mandatory obligations, enforcement mechanisms including civil penalties up to $40,000 per affected individual, and enforcement authority granted to both the FTC and state attorneys general.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress; Senator Catherine Cortez Masto; Senate Committee on Commerce, Science, and Transportation
• Summary: The bill was introduced in the United States Senate by Senator Cortez Masto and referred to the Committee on Commerce, Science, and Transportation, indicating Congress as the proposing authority.

Target

• Entity Types: AI_Developer, AI_Deployer, AI_Infrastructure_Provider
• Entities: covered entities (entities that collect, process, store, or disclose covered data relating to 50,000 or more individuals annually); third party service providers; common carriers subject to the Communications Act of 1934
• Summary: The Act applies to 'covered entities' defined as any entity that collects, processes, stores, or discloses covered data relating to 50,000 or more individuals during any 12-month period. This includes technology companies, data processors, and service providers handling personal data.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Federal Trade Commission (FTC); State Attorneys General; other authorized state officials
• Summary: The Act grants enforcement authority to the Federal Trade Commission and state attorneys general, with the FTC having primary federal enforcement responsibility and states able to bring parens patriae actions on behalf of residents.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Federal Trade Commission; privacy protection officers (designated by covered entities); National Science Foundation; National Institute of Standards and Technology; Office of Science and Technology Policy
• Summary: The Act requires covered entities to designate privacy protection officers who conduct audits and maintain compliance records. The FTC has oversight authority, and various federal agencies coordinate on privacy-enhancing technology research and standards development.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document does not explicitly reference AI lifecycle stages but establishes data governance requirements that would apply across the entire lifecycle of data processing systems. The requirements for data minimization, security practices, and ongoing monitoring suggest implicit coverage of deployment and operational stages.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

No technical scope terms identified.

Technical Scope Summary

The document does not explicitly mention AI models, AI systems, or any specific AI categories. It is a general data privacy law that applies to any entity collecting, processing, storing, or disclosing covered data, regardless of whether AI technologies are involved. The scope is defined by data processing activities rather than AI-specific technologies.