To establish the Data Protection Agency.
Analysis under review: This bill has generated analysis that may be too generic or incomplete. Clause-level evidence remains available below.
Summary
What This Bill Does
This bill creates the Data Protection Agency, a new independent federal agency responsible for regulating how companies collect, use, and share personal data. The agency would have authority to issue rules, conduct examinations of large data aggregators, and enforce federal privacy laws.
Who Benefits and How
Consumers and the general public gain new privacy rights including the ability to access, correct, limit processing of, and request deletion of their personal data. Civil rights groups benefit from provisions requiring the agency to prevent discrimination based on protected classes in data processing. State attorneys general retain authority to enforce these provisions alongside the federal agency.
Who Bears the Burden and How
Large technology companies and data aggregators (those with over $25 million in annual revenue or collecting data on 50,000+ individuals) face significant new compliance requirements including examinations, reporting obligations, risk assessments for high-risk data practices, and potential assessments/fees to fund the agency. The Federal Trade Commission loses its authority to prescribe rules under federal privacy laws (transferred to the new agency).
Key Provisions
- Creates the Data Protection Agency with a Senate-confirmed Director serving a 5-year term
- Defines unlawful, unfair, deceptive, abusive, or discriminatory data practices
- Establishes supervision and examination authority over large data aggregators
- Authorizes assessments on large data aggregators to fund agency operations
- Preserves state privacy laws that provide greater protections than federal law
Evidence Chain:
This summary is generated from the full bill text using AI analysis. Expand "Detailed Analysis" below for identified beneficiaries/burden bearers with clause-level evidence links.
At a Glance
What This Bill Does
Establishes the Data Protection Agency as an independent federal agency to regulate personal data collection, processing, and sharing by data aggregators and enforce federal privacy laws.
Key Policy Areas
Privacy, Technology, Consumer Protection, Civil Rights
Primary Purpose
Establishes the Data Protection Agency as an independent federal agency to regulate personal data collection, processing, and sharing by data aggregators and enforce federal privacy laws.
Policy Domains
Data Protection Act of 2024
Identified Gains
- Consumers/general public
- Civil rights advocates
- Privacy advocacy groups
- State attorneys general
Identified Costs
- Large technology companies
- Data aggregators
- Federal Trade Commission
Legislative Progress
IntroducedMrs. Gillibrand introduced the following bill; which was read twice …
Stakeholder Effects
cui bono?How this legislation distributes effects. Mention counts reflect frequency, not effect magnitude.
Congress, Consumer Financial Protection Bureau, Data Protection Agency
Data Protection Agency faces effects in multiple directions
Positive-direction: Congress, FTC and DOJ antitrust divisions, Federal government/new agency employees
Negative-direction: Federal Trade Commission
Data aggregators and service providers, Data aggregators operating in multiple states, Data aggregators under investigation
Companies pursuing data-related mergers, Large technology companies, Technology and data science professionals
Positive-direction: Technology and data science professionals
Negative-direction: Companies pursuing data-related mergers, Large technology companies, Technology companies, Technology companies collecting personal data, Technology companies under investigation
Privacy and compliance professionals, Privacy and data protection professionals, Third-party vendors and consultants
Positive-direction: Privacy and compliance professionals, Privacy and data protection professionals
Negative-direction: Third-party vendors and consultants
State attorneys general, State privacy regulators
Bill Structure & Actor Mappings
Who is "The Secretary" in each section?
- "the_agency"
- → Data Protection Agency
- "the_director"
- → Director of the Data Protection Agency
Key Definitions
Terms defined in this bill
The Data Protection Agency established under section 3
Any person that collects, uses, or shares, in or affecting interstate commerce, an amount of personal data that is not de minimis, as well as entities related to that person by common ownership or corporate control; does not include an individual who collects, uses, or shares personal data solely for non-commercial reasons
Information regarding the physiological or biological characteristics of an individual that may be used to establish identity, including genetic data, fingerprints, facial imagery, voice recordings, and derived algorithmic models
Information that does not identify an individual and with respect to which there is no reasonable basis to believe the information can be used to identify an individual
A computational process, including one derived from machine learning, statistics, or other data processing or AI techniques, that automates, analyzes, aids, or augments decisions
We use a combination of our own taxonomy and classification in addition to large language models to assess meaning and potential beneficiaries. High confidence means strong textual evidence. Always verify with the original bill text.
Learn more about our methodology