In an article published on November 29, Nick Ortner discusses his concerns about the impact of US privacy rights law (“APRA”) on small businesses. In summary, APRA is a proposed federal data privacy law that would solve the compliance nightmare created by the current patchwork of state data privacy laws.
There are currently 19 states with comprehensive data privacy legislation with various requirements, restrictions and other provisions.
As with any legislation regulating businesses, there is great concern about its impact on small businesses, a concern Ortner echoes in his article. Notably, Ortner writes:
“Some lawmakers say APRA will only impact huge data brokers. But the bill covers any business that generates more than 200,000 data points each year, that is, information obtained by clicking on ads or visiting websites. This figure seems high, but many small businesses easily exceed it. Indeed, in the digital age, even a small family business like mine can have customers all over the world. We have nothing in common with the big data brokers, but APRA would regulate us in exactly the same way.
Ortner’s characterization of APRA’s application to small businesses is not complete. APRA exempts from its application what it defines as a “small business”. A business meets the definition of “small business” provided it meets three thresholds.
First, the business has not generated average annual gross revenues over the preceding three years of $40,000,000 or more. Second, that the company does not transfer APRA-covered data in exchange for revenue or anything of value. Third, and regarding the 200,000 figure in Ortner’s article, the company does not process the data of more than 200,000 people “for purposes other than initiating, rendering, billing , finalize, complete, or otherwise collect payment for a requested service or product.” .”
In other words, simply processing the data of 200,001 individuals would not exceed this threshold, provided that the processing is aimed simply at providing services to consumers.
I don’t know if APRA still applies to Ortner’s activities, but APRA’s drafters have, as Ortner points out, “carefully considered the impact of APRA.” Specifically, the drafters sought to avoid trapping small businesses that process data simply to provide services and products to their consumers.
John Haskell is an attorney in Topsham, Maine.