Bussiness
Opinion: Piece about APRA’s impact on small business is incomplete
In a piece published November 29, Nick Ortner discusses his concerns about the impact of the American Privacy Rights Act (“APRA”) on small businesses. Succinctly, the APRA is proposed federal data privacy legislation that would address the compliance nightmare created by the current patchwork of state data privacy legislation.
There are currently 19 states with comprehensive data privacy legislation with varying requirements, restrictions, and other provisions.
As with any legislation regulating business, concern abounds about the impact on small business, a concern Ortner echoes in his piece. Notably, Ortner writes:
“Some lawmakers say APRA will only impact huge data brokers. But the bill covers any business that annually generates more than 200,000 data points — bits of information from doing things like clicking ads or visiting websites. That sounds like a big number, but many small businesses easily surpass it. That’s because in the digital age even a little family business like mine may have customers worldwide. We have zero in common with massive data brokers, but APRA would regulate us in exactly the same way.”
Ortner’s characterization of the APRA’s application to small businesses is not complete. The APRA exempts from its application what it defines as a “small business.” A business meets the definition of “small business” provided it stays within three thresholds.
First, that the business does not have average annual gross revenues for the preceding three years of $40,000,000 or more. Second, that the business not transfer data covered by the APRA in exchange for revenue or anything of value. Third, and as to the 200,000 figure in Ortner’s piece, the business not process the data of more than 200,000 individuals “for any purpose other than initiating, rendering, billing for, finalizing, completing, or otherwise collecting payment for a requested service or product.”
In other words, merely processing the data of 200,001 individuals would not exceed this threshold, provided the processing is merely to provide services to consumers.
Whether the APRA still applies to Ortner’s business is beyond the scope of my knowledge, but the drafters of the APRA have, as Ortner urges, “consider[ed] APRA’s impact carefully.” Specifically, the drafters have sought not to ensnare small businesses who process data merely to provide services and products to their consumers.
John Haskell is an attorney in Topsham, Maine.
Travel Trends Report 2025: Hyper-Personalisation
Here’s what the average gym-goer’s fitness routine looks like
Does the Galaxy S24 Ultra's great screen come with a great problem?
AAA holiday forecast: Record-breaking travel expected on roads, at airports
Is title number 20 inevitable for Club Brugge? – Get Belgian & Dutch Football News
‘Flying naked’ is the latest travel trend dividing the internet, and it doesn’t mean what you think
Get An Exclusive Upper Body Blaster Workout From Fitness Director, AT
Navigating a Changing World: Why Values, Adaptability, and Resilience Matter More Than Ever
The cold has arrived. Here’s some indoor activities in Holland to explore
