Experts Warn Against Private Right to Action Laws on Data Privacy Day
If laws are robust enough and enforcement agencies are well-resourced, states should avoid implementing right to privacy action legislation.
WASHINGTON, January 31, 2022 – Experts gathered virtually on Data Privacy Day on Thursday to revisit strategies to best hold companies accountable for the information they collect on their users.
Much of the conversations that took place on Thursday centered on the private right of action – whereby private citizens can legally pursue companies in lieu of government action. Though some experts view the practice favorably, most speakers were hesitant to support it.
“[Private right of action] has historically been used as a tool to harass businesses and create opportunities for frivolous claims,” ACT state policy associate Caleb Williamson said during a panel with the Information Technology Innovation Foundation. ACT is a trade organization that represents thousands of small tech companies and app makers.
Carl Holshouser, TechNet vice president for operations and strategic initiatives, pointed out that though the spirit of enabling private right to action may be to target big tech companies, small businesses are often caught in the crossfire and are the ones that get left paying the price. TechNet is a network of technology executives with the goal of promoting growth and innovation in the tech sector.
He acknowledged that while there can be benefits to right to action laws, they have resulted in more harm than good. “We all agree that where there is malfeasance and bad actors and consumers are harmed, there needs to be a mechanism with which to deal with that,” Holshouser said.
“But a wide private right of action leads to something that we have seen with the California privacy law. Since [2020], when it was enacted, there have been nearly 200 lawsuits that have been brought against companies who do business in California digitally but are looking at somewhere else that are mostly small businesses,” Holshouser added.
“Now, imagine if you’re a smaller startup that is in Kansas and your website reaches California. Here comes a lawyer that is suing you and says there is malfeasance, and you need to be sued and there has to be a settlement,” Holshouser continued. “This is a chilling effect on innovation and on small businesses that shows you why private right of action is too far.”
Private right of action alternatives
During an R Street event on Thursday, Jessica Rich, former Federal Trade Commission director of the Bureau of Consumer Protection, enumerated a list of items that should be employed as an alternative to right of action laws.
“If a law is strong enough in its provisions – in terms of protecting consumers plus the FTC is given adequate enforcement authority and resources plus the state and [attorneys general] can enforce that [law] – maybe you are making it less necessary to have a private right of action,” Rich said.
“Another solution that I am seeing in some legislation is that in addition to state agencies being able to enforce the law, other agencies in the state with jurisdiction over privacy,” Rich continued. “[They] could enforce the law, which could include more local agencies, and as long as they’re enforcing those same laws and the same standards, there could be that could even cover the field even more without me for a private right of action.”
