Necessary and proportionate: the ADPPA test that outlived the bill
The federal privacy bill that cleared committee 53 to 2 never reached the floor. Its minimization test did outlast it, and banks and hospitals were more exposed to that test than their sector carve-outs suggested.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On July 20, 2022, the House Energy and Commerce Committee voted 53 to 2 to advance the American Data Privacy and Protection Act. The bipartisan bill’s discussion draft had appeared in early June. It would have limited the collection, processing and transfer of personal data to what was reasonably necessary and proportionate. The benchmark was a product or service the individual requested, or a listed permitted purpose. It added heightened protections for sensitive data, a private right of action phased in after enactment, and broad preemption of state comprehensive privacy laws, with listed exceptions. Entities complying with the Gramm-Leach-Bliley Act or HIPAA would be treated as compliant with related provisions for data those laws covered. California officials opposed the preemption terms, and the bill did not reach a House floor vote.
American privacy law had long run on notice and choice: tell people what you collect, and let them opt out of some uses. The ADPPA began elsewhere. Its central duty asked whether each piece of data was needed at all, and consent could not cure a collection that failed that test. The bill died, but the test did not. It shaped state laws, enforcement theories and the federal drafts that followed.
For banks, health systems and agencies, the bill is worth reading in three parts that answer separate questions. The first is what the minimization test actually demands of systems. The second is how far it reached into regulated organizations despite their sector carve-outs. The third is why preemption sank the bill, and what that left organizations to plan for.
What the test demands of systems
A duty of minimization is a design rule. It cannot be met by a better privacy notice. It requires each data element to be tied to a purpose, and each purpose to be one the law accepts. That has practical consequences across the data estate.
Collection is the obvious one. Forms, mobile apps and web pages collect fields because someone once thought they might be useful. A minimization review asks the product owner to name the purpose for each field and removes those without one. Use comes next. Data collected to service an account may not be fair game for a new marketing model. Analytics teams need purpose tags on data sets and a review step before data moves to a new use. Retention is the third. Data that was necessary at onboarding may not be necessary five years later, and the schedule has to say when it goes.
Models raise the stakes. Training data is usually assembled from whatever is available, and a model trained on data collected for another purpose carries that purpose problem into every prediction it makes. A minimization regime asks model owners to document the source and purpose of their training sets. It asks them to drop fields that add risk without adding accuracy, and to consider whether aggregated or de-identified data would do the job. Those steps cost some modeling convenience. They also make models easier to explain to examiners who ask what drove a decision.
Most organizations found the hard part was evidence. A regulator applying a necessity test asks why a field exists, and the answer has to be written down before the question arrives. A data inventory that records purpose, legal basis and retention for each major data set is the core artifact. Building it is tedious. It also pays twice, because the same inventory drives security classification, breach scoping and records management.
How far it reached into regulated firms
Banks and hospitals often assumed that a federal privacy law would pass them by. The ADPPA did not quite work that way. Its sector provisions applied to data covered by GLBA or HIPAA. They did not exempt the organization as a whole.
That distinction mattered because regulated organizations hold a great deal of data outside their sector laws. A bank’s customer account records sit under GLBA. Its website analytics, prospect lists, event registrations and some marketing data may not. A hospital’s medical records sit under HIPAA. Its public website tracking, donor files and consumer wellness app may not. Under a data-level carve-out, all of that falls under the general privacy law, including the minimization test.
Several states were already moving the same way, and more did later. For a compliance leader, the practical step was a map of every data set that sits outside the sector law, with an owner for each. In most organizations the marketing technology stack was the largest item on that list. It was also the least governed. Organizations should check with counsel on how exemptions apply in each state where they operate.
Why preemption sank it, and what that left
The bill’s main obstacle was its relationship to state law. California had a comprehensive law and a new privacy agency. Its officials argued that a federal ceiling would weaken protections Californians already had. Supporters answered that one national rule would protect people in every state and spare organizations a patchwork. Each side had a case, and the dispute was never settled.
The planning consequence was clear even in 2022: assume a patchwork. That means a program built on the strictest common requirements, with state-specific rights and definitions layered on top. Minimization is the most efficient common floor, because it reduces the data every other obligation applies to. Data that is not collected needs no access request process, no breach notice and no retention schedule.
A patchwork also changes the build. Privacy request handling, consent records and opt-out signals need to be configurable by state, not hard-coded to one law. Vendors that process personal data need contract terms that follow the strictest applicable rule, since a vendor cannot easily treat one state’s residents differently in the same database. And the inventory described above needs a jurisdiction field, so that a new state law becomes a query and a gap list rather than a new project.
The trade-off is cost. Applying the strictest standard everywhere means giving up some data uses that would be lawful in more permissive states. Most regulated organizations found that a reasonable price for a single program they could explain to examiners, auditors and customers.
With hindsight
The ADPPA did not return in the next Congress. A successor, the American Privacy Rights Act, appeared as a discussion draft in April 2024 and also stalled over preemption and private enforcement. States kept legislating, and by 2026 roughly twenty have comprehensive privacy laws. Maryland’s law, enacted in 2024, adopted a strict necessity standard for sensitive data, close in spirit to the ADPPA’s test. Several states narrowed entity-level exemptions for financial institutions toward data-level ones. The Federal Trade Commission continued to bring sensitive data cases under its existing authority. Federal preemption remains unresolved in 2026. For regulated organizations the outcome is the one that was foreseeable in 2022: a patchwork that is cheapest to run from a single minimization-first program with a purpose-tagged data inventory at its center.