Data Protection Act of 2024

The Data Protection Act of 2024 establishes a new Data Protection Agency to regulate how companies collect, process, and share personal data. It requires large data aggregators (companies collecting data from 50,000+ individuals or with over $25 million in annual revenue) to conduct risk assessments before implementing "high-risk data practices" such as automated decision systems, biometric processing, profiling, or consumer scoring for employment, credit, or housing. The law mandates post-implementation impact evaluations and creates civil penalties of up to $1 million per day for intentional violations, with fines distributed to victims through a new Civil Penalty Fund. The agency will enforce these requirements while coordinating with other federal agencies like the FTC and Consumer Financial Protection Bureau.