Lawmakers have released draft bipartisan comprehensive privacy legislation – the “American Data Privacy and Protection Act.” The Act borrows a number of concepts from previously introduced legislative proposals but also includes a few novel approaches. While the bill recognizes several exceptions to its requirements, it prohibits covered entities from collecting, processing, or transferring covered data beyond what is “reasonably necessary, proportionate, and limited to” 1. Provide or maintain a “specific product or service requested by an individual,” or communication by the covered entity to the individual “reasonably anticipated within the context of the relationship” or 2. A purpose expressly permitted by the bill.
