In this case, I think it’s probably more so that it could be a lot better. Idk all the details and people always try to sneak shit in, but this (admittedly short) article sounds promising.
APRA includes language from California’s landmark privacy law allowing people to sue companies when they are harmed by a data breach. It also provides the Federal Trade Commission, state attorneys general, and private citizens the authority to sue companies when they violate the law.