Bussiness
Opinion: Piece about APRA’s impact on small business is incomplete
In a piece published November 29, Nick Ortner discusses his concerns about the impact of the American Privacy Rights Act (“APRA”) on small businesses. Succinctly, the APRA is proposed federal data privacy legislation that would address the compliance nightmare created by the current patchwork of state data privacy legislation.
There are currently 19 states with comprehensive data privacy legislation with varying requirements, restrictions, and other provisions.
As with any legislation regulating business, concern abounds about the impact on small business, a concern Ortner echoes in his piece. Notably, Ortner writes:
“Some lawmakers say APRA will only impact huge data brokers. But the bill covers any business that annually generates more than 200,000 data points — bits of information from doing things like clicking ads or visiting websites. That sounds like a big number, but many small businesses easily surpass it. That’s because in the digital age even a little family business like mine may have customers worldwide. We have zero in common with massive data brokers, but APRA would regulate us in exactly the same way.”
Ortner’s characterization of the APRA’s application to small businesses is not complete. The APRA exempts from its application what it defines as a “small business.” A business meets the definition of “small business” provided it stays within three thresholds.
First, that the business does not have average annual gross revenues for the preceding three years of $40,000,000 or more. Second, that the business not transfer data covered by the APRA in exchange for revenue or anything of value. Third, and as to the 200,000 figure in Ortner’s piece, the business not process the data of more than 200,000 individuals “for any purpose other than initiating, rendering, billing for, finalizing, completing, or otherwise collecting payment for a requested service or product.”
In other words, merely processing the data of 200,001 individuals would not exceed this threshold, provided the processing is merely to provide services to consumers.
Whether the APRA still applies to Ortner’s business is beyond the scope of my knowledge, but the drafters of the APRA have, as Ortner urges, “consider[ed] APRA’s impact carefully.” Specifically, the drafters have sought not to ensnare small businesses who process data merely to provide services and products to their consumers.
John Haskell is an attorney in Topsham, Maine.
Peak holiday travel period to begin soon
Loafer bags to sock shoes, 2024 was all about the mashed-up accessory
Android 15 QPR2 Beta 2 update rolling out to Pixel phones
Entertainment Update
New Traveloka Study Unveils Shifting Travel Trends in Japan
2024 was the year of whiplash-inducing cultural and internet trends
Frustrated on not losing weight despite workout and diet? Fitness coach shares 5 hidden signs you are becoming more fit
Tucson-area business steps up to help families with unfinished pools
Raheem Morris on Kirk Cousins: “He’s got to play better”
