The SECURE Data Act: How Does it Compare to the GDPR and What Might it Mean for UK and EU Businesses?

Would apply only to larger businesses (revenue over $25,000,000) and / or businesses that process a lot of personal data (over 100,000 people).

For more detail on the thresholds, see here. 

Would apply only to personal data linked to a U.S. consumer, meaning individuals acting in their individual or household capacity, and would not include individuals acting in their commercial (business-to-business) or employment context.  

Applies to personal data linked to individuals regardless of whether they are acting in a private or commercial capacity.

The SECURE Data Act has extraterritorial reach if an organization outside the U.S. is engaged in commerce in the US.

The GDPR has extra territorial effect and can apply to organizations outside the UK/EU, even if they have no offices, staff or servers there. For example, if an organization outside the UK/EU targets or monitors individuals in the UK/EU.

The SECURE Data Act would set out a number of principles relating to the processing of personal data; this is not an exhaustive list. 

Data would need to be processed in a transparent manner. 

The principle of data minimization would apply, and controllers would be required to limit the collection of personal data to what is adequate, relevant and reasonably necessary for the purpose.

Data security obligations would be imposed on the controller who must implement, and maintain reasonable administrative, technical, and physical data security practices.

GDPR sets out a number of principles relating to the processing of personal data; this is not an exhaustive list. 

Data must be processed lawfully, fairly and in a transparent manner.

The principle of data minimization applies and organizations must only process the personal data that is necessary for the purpose.

Data must be processed in a manner that ensures appropriate security of the personal data including using appropriate technical or organizational measures.

An ‘‘identified or identifiable natural person’’ is a person who can be readily identified, directly or indirectly.

The term "controller" refers to a person who, alone or jointly with others, determines the purpose and means of processing personal data.

The term "processor" is a person that processes personal data on behalf of a controller.

The term "pseudonymous data" refers to personal data which cannot be attributed to an individual without the use of additional information.

A number of definitions/concepts have no equivalent in GDPR. For example, "data broker" and "covered nation".

The data subject is defined as an "identified or identifiable natural person".

The term "controller" refers to a person/entity which, alone or jointly with others, determines the purposes and means of the processing of personal data. 

The term "processor" is a person/entity which processes personal data on behalf of a controller.

The term "pseudonymisation" refers to the processing of personal data in such a way that it cannot be attributed to a data subject without the use of additional information.

A number of definitions have no equivalent definition in the draft SECURE Data Act.  For example, "personal data breach" and obligations on the controller to notify such a breach, in certain circumstances, to the relevant supervisory authority.

Consumers would have a number of rights (which are not absolute and are subject to certain exceptions):

• Right to confirm if processing and access a copy of personal data
• Right to correct
• Right to delete
• Right to data portability
• Right to opt out of targeted advertising (expressly excludes measurement or ad reporting), sale, profiling
• Right to appeal within the controller business.

Data subjects have a number of rights regarding the processing of their personal data (which are not absolute and are subject to certain exceptions) including:

• Right to confirm if processing and access a copy of personal data
• Right to correct or complete
• Right to erasure (right to be forgotten)
• Right to restriction of processing
• Right to data portability
• Right to object to processing

• Restrictions on automated decision making (see more below)

   

Controller and processor roles

The Act includes clear separation of controller and processor roles.

The Act would require the data processor to undergo assessments to demonstrate compliance with the Act.

The Act would require a contract between the controller and processor to govern the processor's data processing procedures. The contract must include certain minimum requirements.

GDPR includes clear separation of controller and processor roles.

The data controller must only use processors that provide sufficient guarantees that they will implement appropriate technical and organizational measures to ensure their processing meets GDPR requirements. 

GDPR requires the controller and processor to enter into a binding contract which contains a number of compulsory provisions.

The Act includes a specific section on international data flows.

The Act would direct the Secretary of Commerce to advise on policy relating to the international flow of personal data.

GDPR includes detailed provisions on cross border transfers that relate to ensuring an adequate level of privacy protection when data is sent outside the UK / EU.

Higher standard for processing “sensitive data.”

The Act provides an opt-in framework: companies would have to obtain a consumer’s “specific, informed, and unambiguous agreement” before collecting, selling, or using consumers’ sensitive data in any way.

"Sensitive data" includes racial or ethnic origin, religious belief, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; (2) genetic or biometric data that is processed for the purpose of uniquely identifying a specific individual; (3) personal data collected from a child or teen; and (4) precise geolocation data.

Higher standard of protection for special categories of personal data.

There are 10 conditions under which special categories of personal data can be processed. One of which is explicit consent from the data subject. 

GDPR special category data is defined similarly to US "sensitive data" with the notable differences being the GDPR also includes political opinions and trade union membership but does not cover precise geolocation data.

Child data is not classified as special category data but is given specific protection elsewhere in the GDPR.

The Act largely does not address personal data being processed for automated decision making, except in the context of profiling to make legal or significant decisions through automated means.

Contains provisions on automated decision making and profiling (noting there are some divergences between the UK and EU regimes).

The Federal Trade Commission (FTC) would be the primary enforcer of the Act, with the authority to enforce the Act against FTC-regulated businesses and common carriers subject to the Communications Act. The FTC would have rights to seek injunctive relief. 

State attorneys general would also have the ability to enforce the Act, including rights to seek injunctive relief.

Enforcement is by the relevant supervisory authority.

In the UK this is the Information Commissioner's Office.

In the EU, this is the supervisory authority in the relevant member state (for example, CNIL in France). 

The supervisory authorities have broad powers including the right to issue reprimands, ban processing, and order rectification or erasure of data.

No GDPR style fines regime, however, the FTC would have authority to obtain civil penalties, which are presently up to $53,068 per violation (periodically adjusted for inflation). State regulators would have the authority to seek damages (limited to actual harm to residents of their state).  

Administrative fines apply up to a maximum of £17,500,000 or 4% of an undertaking's total worldwide annual turnover, whichever is higher. These fines can be significant.

Express right for individuals to claim compensation for breaches of the GDPR.