# Data Protection Act of 2024 Summary
This bill establishes a new independent federal agency called the Data Protection Agency to regulate how companies collect, process, and share personal data. The agency would be headed by a Director appointed by the President and confirmed by the Senate, and would have broad authority to write rules, conduct investigations, and enforce penalties against data aggregators—defined as companies with annual revenues exceeding $25 million or that collect data on 50,000 or more individuals.
The agency would oversee "high-risk data practices," including the use of automated decision systems to make determinations about employment, credit, insurance, housing, and other important services, as well as the collection of biometric data and processing of information about protected classes like race, religion, or disability. Companies would be required to conduct risk assessments before deploying high-risk practices and impact evaluations afterward. The bill consolidates existing privacy authorities from the Federal Trade Commission and other federal laws under this new agency's jurisdiction.
The agency would be funded through fees collected from large data aggregators, with revenues held in a separate fund at the Federal Reserve. Civil penalties for violations range from $5,000 to $1 million per day depending on the severity and intent, with higher penalties ($15,000 to $3 million per day) when children's data is involved. Penalties collected would be placed in a victims relief fund to compensate people harmed by data misuse. The agency would also maintain a public complaint database and coordinate with other federal agencies and state regulators to enforce privacy protections consistently.
Take Action
Your position
Add a comment
to comment on this bill.
Annotate the text
Highlight any passage on the Summary or Full Text tab to attach a note. Annotations appear on the Annotations tab.