Data Protection Act of 2021

This bill establishes the Data Protection Agency, an independent agency to regulate specified high-risk data practices and the collection, processing, and sharing of personal data. This includes the transfer of the powers and duties with respect to specified federal privacy laws from the Federal Trade Commission to the agency.

Among other functions, the agency must oversee the use of high-risk data practices, which include (1) using automated decision systems, such as machine learning; (2) profiling individuals on a large scale; (3) and processing personally identifying biometric information, such as genetic data. The agency also must prevent and remediate specified privacy harms (i.e., commercial practices that may lead to an adverse outcomes resulting from the collection, processing, or sharing of personal data).

The agency is authorized to collect fees from large data aggregators (i.e., large commercial entities that collect, use, or share the personal data). The agency also may require periodic reports and conduct periodic examinations of large data aggregators.

The bill authorizes the agency to prescribe rules, issue orders, and otherwise enforce violations of this bill and other privacy laws.