Data Privacy in the Age of GenAI

This commentary analyzes the proposed American Privacy Rights Act (APRA), outlining stricter organizational accountability requirements (e.g., CEO certifications, audits, PIAs) and highlighting gaps in algorithmic transparency, service provider responsibilities, and enforcement. It underscores risks posed by generative AI bias and opacity, argues for human oversight of AI-driven decisions, and stresses the need to protect consumer data amid persistent threat actor interest, while noting APRA is a strong start that still requires refinement.