Know Your Digital Rights

The published framework treats biometric identifiers as highly sensitive and includes biological and behavioral identifiers, plus derived templates, embeddings, and vectors used for identification or persistent recognition.

The framework distinguishes isolated observations from persistent or aggregated histories. The proposed Act considers duration, precision, continuity, persistence, retrospective capability, aggregation, and what the combined information reveals.

The proposed Act calls for independent human review for covered automated decisions affecting substantial legal interests. Mere approval, acknowledgment, transmission, execution, or confirmation would not qualify.

The proposed Act addresses government acquisition by proxy and preserves lawful access to records needed for oversight. Contracts, hosting arrangements, and proprietary systems should not become barriers to lawful accountability, while legitimate trade-secret and security information can still be protected from unnecessary public disclosure.

Covered high-consequence systems would preserve audit evidence for material access, use, disclosures, administration, configuration changes, remote access, errors, security events, and required human review.

The proposed Act says a high-consequence system cannot be the sole nonverifiable authoritative evidence of its own material output. Certification, vendor testing, procurement acceptance, or a technical standard alone would not automatically count as independent verification.

The proposal limits collection, generation, retention, use, and dissemination to what is reasonably necessary and proportionate, while preserving records when another legal duty requires it.

The proposal addresses material changes through impact-assessment and procurement provisions, including analytical functions, data categories, sharing, remote administration, update authority, vendors, subprocessors, and material operational dependencies.