Should private individuals be able to sue companies such as Facebook or Twitter for abusing their data? That is the question where Republicans and Democrats have been entangled for months, while they are working on a new law on data privacy. But the talks have come to a halt in recent weeks, and instead of submitting a two-part bill, both parties have now opted to take their own measures to promote their positions.
Last week, Democrats, led by Senator Maria Cantwell (D-WA), presented the Consumer Online Privacy Rights Act of 2019 (COPRA), which would give American consumers a slate of new rights to the data they produce on platforms such as Facebook and Google. These rights would oblige companies to provide more transparency about user data and allow users to delete, correct or transfer it to a competitive service. These basic principles have become the basis for every federal bill to regulate how a platform handles the data of its users. These rules closely imitate the protection offered by the General Data Protection Regulation of the European Union, a law that Mark Zuckerberg has said it must be maintained abroad or used as a guide for new rules in the states.
"In the growing online world, consumers deserve two things: privacy rights and a strong law to enforce them," Cantwell said in a statement. "They must be like your Miranda rights – clear as a bell about what they are and what constitutes a violation."
The same rights to correct and transfer data are largely reflected in the draft proposal by Senator Roger Wicker (R-MS), the United States Consumer Data Privacy Act of 2019. According to the Wicker bill, the FTC would be the main enforcer of the law, supported by prosecutors. Democrats agree that both the FTC and the states must enforce every law, but it is the right of a consumer to sue a technology company for data abuse that is blocking legislation.
Private law of action, or the ability to sue platforms for violating the rules introduced by future federal privacy legislation, has become the center of the current debate. Democrats have amply supported the provision as a way to ensure that Facebook and Twitter are held responsible for the data scandals they create. Republicans disagree and suggest that it would cause a storm of frivolous lawsuits that would have major consequences for small businesses rather than the Big Tech industry.
A private right of action serves as a third level of enforcement for every data privacy law. Both Republicans and Democrats broadly agree that the Federal Trade Commission must enforce any law at federal level and that state attorneys-general should be empowered to take matters on. But these offices can only handle so many investigations at a time, and without allowing individuals to sue bad actors, proponents fear that many cases, some of them affecting minority groups, may fall through the cracks.
"Private law of action for marginalized communities is really critical," said Dylan Gilbert, policy adviser at Public Knowledge. “Marginalized communities have traditionally been unable to rely on the government to protect their interests. It is really important that individuals can have their own day in the courtroom. "
But Republicans provide a world with a private right to data abuse action in which literate lucky lawyers take innumerable class actions against both Big Tech and small businesses. There is some evidence to support them: in 1991, the Consumer Consumer Protection Act or TCPA gave consumers a private right to action against telemarketers and unleashed a stream of class action lawsuits. According to the National Law Review, the number of class actions that reported TCPA violations, increased by more than 1,000 percent between 2010 and 2016. Republicans are afraid that the same could happen if the provision was included in privacy legislation.
But lawsuits over misuse of data are far from frivolous, said Professor Ari Ezra Waldman, director of the Innovation Center for Law and Technology at the New York Law School. As Waldman sees it, they would enforce the law and send companies to better practices. "First you must be subject to the statute, and you must violate the statute, and then someone must actually know that you are violating that statute," Waldman said. "It is much more likely that this will affect larger players and the worst actors."
Earlier this month, Senator Wicker said Communication daily that he did not expect Democrats to push a private right of action if it meant that the two parties could not reach an agreement. "I don't think Democrats will insist on that in a final bill," Wicker said. "I don't expect this congress to be to the left of the California initiative." With the introduction of COPRA last week, any chance of a bipartisan bill from Wicker-Cantwell without this provision seems unlikely.
But on Monday, Wicker seemed open to a more limited private right of action than what the Democrats have proposed so far. Wicker told Bloomberg Government that each provision should be "a fairly scary, provisional, or something similar." A provisional provision would essentially be a court that orders a defendant to stop a certain kind of behavior through civil courts, but it would not produce the same payouts to consumers and lawyers that would be extended under Cantwell's account.
Republicans and democrats disagree on other issues, such as nullifying state privacy legislation and authorizing the FTC, but tomorrow's hearing can be heavily focused on a private right to act. "We can pass any law we want," said Waldman. "But if there is no way to enforce them, then what's the point?"