Should private individuals sue businesses like Facebook or Twitter for misusing their data? That's the question that Republicans and Democrats have been asking for months to come up with a new privacy law. But the talks have stalled in recent weeks, and instead of adopting a bipartisan law, both parties have now decided to introduce their own measures to stake out their positions.
Last week, Democrats, led by Senator Maria Cantwell (D-WA), released the Consumer Online Privacy Rights Act of 2019 (COPRA), which gives American consumers new rights to the data they produce on platforms such as Facebook and Google , These rights would require that companies create more transparency about user data and give users the ability to delete, correct or transfer them to a competing service. These basic principles are the basis for any federal bill that seeks to regulate how a platform deals with its users' data. These rules imitate the protection of the General Data Protection Regulation of the European Union, a law that, according to Mark Zuckerberg, should be enforced abroad or serve as a guideline for new regulations in the states.
"In the growing online world, consumers earn two things: privacy rights and a stringent law to enforce them," Cantwell said in a statement. "They should be like your Miranda rights ̵
The same rights to correct and transmit data are largely reflected in the draft by Senator Roger Wicker (R-MS) Proposal, the United States Consumer Data Privacy Act of 2019. According to Wickers Law, the FTC would be the main interpreter of the law supported by Attorney Generals. Democrats agree that both the FTC and the states should enforce laws, but it is the consumer's right to sue a technology company for misuse of data that is holding back legislation.
Private action law or the possibility to sue platforms for violating the provisions of a future Federal Data Protection Act has become the focus of the current debate. The Democrats have largely supported the provision to ensure that Facebook and Twitter are held accountable for the data scandals they cause. The Republicans disagree, suggesting that there would be a storm of lighthearted lawsuits that would have a big impact on small businesses rather than the big tech industry.
A private right of action serves as the third enforcement level for any privacy laws. Both Republicans and Democrats agree on the whole that the Federal Trade Commission should enforce federal laws and prosecutors should have the power to handle cases as well. But these offices can only handle so many investigations at the same time and do not empower individuals to sue bad actors. They fear that many cases, some of which affect minorities, could fall through the cracks.
"Private action for marginalized communities is really critical," said Dylan Gilbert, political consultant at Public Knowledge. "Marginalized communities have not relied on the government to protect their interests in the past. It is really important that individuals have their own day in court.
However, Republicans envisage a world with a private right to data misuse, in which devout lawyers make countless class actions against large and small businesses. There is some evidence for this: in 1991, the Consumer Telecommunications Law (TCPA) gave consumers a private right of action against telemarketers and triggered a flood of class action lawsuits. According to the National Law Review the number of class action lawsuits for TCPA violations increased by over 1,000 percent between 2010 and 2016. Republicans fear that the same thing could happen if the provision is contained in a privacy act.
Complaints about abusive data, however, are far from frivolous, said Professor Ari Ezra Waldman, director of New York Law School's Innovation and Technology Innovation Center. According to Waldman, they would enforce the law and lead businesses to better practices. "First you have to be law-abiding and violate the law, and then somebody actually has to know you are violating this law," Waldman said. "It's far more likely that this affects bigger players and the worst actors."
Earlier this month, Senator Wicker told Communications Daily that he did not expect the Democrats would enforce a private right to action if it meant that the two parties could not come to an agreement , "I do not think the Democrats will insist on a final bill," Wicker said. "I do not expect this Congress to shift to the left of the California Initiative." With the introduction of COPRA last week, it is unlikely that a non-partisan Wicker-Cantwell bill will come into being without this provision.
But on Monday, Wicker seemed to be open to a more restricted private right of action than what the Democrats had previously proposed. Wicker told the Bloomberg government that any provision "should be a very tight, interim injunction or something." An interim injunction would essentially mean a court ordering a defendant to suppress a certain type of behavior before the civil courts, but it would not: "• provide consumers and lawyers with the same disbursements that would be extended under Cantwell's account. Republicans and Democrats disagree on other issues such as the lifting of data protection laws and FTC powers, but tomorrow's hearing could focus heavily on private action. "We can pass all the laws we want," Waldman said "But if there is no way to enforce it, what is it about?"