APA Services (APASI) submitted a response (PDF, 250KB)opens in new window to a request for information (RFI) from the House Energy and Commerce Committee concerning the development of a federal comprehensive data privacy and security law. In our feedback, the association underscored the profound implications of data privacy and security for the psychological well-being of individuals and the overall health of society, urging lawmakers to consider the vital role of psychology and psychological science in crafting effective legislation.
"Data privacy and security are not merely technical or legal matters; they are deeply intertwined with our lives and society," APASI stated in the response. The comment highlighted how the collection, use, and potential misuse of personal data can significantly impact individuals' sense of autonomy, control, and safety, thereby affecting their decision-making, relationships, and even their physical and mental health.
APA Services called for a strong federal law grounded in core principles designed to protect consumers:
-
Maximizing transparency and user control: Individuals should have meaningful control over their personal data, supported by clear, understandable, and user-centered disclosures.
-
Minimizing harm: The legislation must prioritize the prevention of harm associated with data breaches, misuse, manipulation, and discrimination.
-
Ensuring accountability: All entities handling personal data must be held accountable for its protection and for respecting individuals' rights.
The association’s detailed feedback addressed several critical areas outlined in the RFI and offered recommendations:
-
Roles and responsibilities: The comment emphasized the need for functional definitions to ensure clear accountability for consumer data and psychological well-being. It called for obligations including transparency in data collection and use, data minimization, robust security measures, and strong accountability mechanisms. APASI cautioned against broad exemptions for small businesses, suggesting a tiered approach to ensure basic protections for all.
-
Personal information, transparency, and consumer rights: APASI advocates for a broad definition of "personal information" and explicitly defines "sensitive personal information" to include health (physical and mental), financial, and demographic data that could lead to harm or discrimination if disclosed. Disclosures must be user-centered, concise, clear, and proactive. Consumer rights should encompass access, correction, deletion, data portability, and protections against discriminatory automated decision-making.
-
Heightened protections for sensitive data: The response stressed the need for heightened protections for sensitive data, particularly mental and physical health information, requiring explicit consent and stricter security, data minimization, and purpose limitation. This includes data from emerging technologies like wearables and neuro-technologies that can infer mental states and cognitive processes, aligning with the recent APA Council of Representatives policy on this issue.
-
Existing privacy frameworks & protections: APASI called for a stringent federal baseline of protection that allows states to implement more rigorous supplementary protections. Harmonization with existing sectoral laws like HIPAA and COPPA must augment, not diminish, current data protection standards.
-
Data security: Recognizing data security as a human issue, recommendations include a risk-based approach, regular audits, employee training, incident response plans, and prompt, transparent data breach notifications designed to empower consumers.
-
Artificial intelligence: APASI strongly supports regulating AI and automated decision-making, emphasizing the need for transparency, explainability, human oversight (especially in high-stakes scenarios), bias mitigation, and the right to contest automated decisions. The comment outlined principles for AI standards, including human-in-the-loop requirements, centering ethics and diverse experiences, more research into AI's human impact, equitable deployment, robust data privacy, and copyright considerations.
The association reiterated the necessity of a comprehensive federal data privacy and security law informed by psychological science to protect individuals and foster responsible innovation. The comment also highlighted the need for provisions to support research on the psychological and societal impacts of data privacy and for public education campaigns.
For more information, contact Corbin Evans.