US Chamber of Commerce Opposed to Private Right of Action for Federal Privacy Legislation

The executive vice president and chief policy officer of the US Chamber of Commerce, Neil Bradley recently issued a statement on federal privacy legislation.

A national data protection law including a private right of action would encourage an influx of abusive class action lawsuits, create further confusion regarding enforcement of blanket privacy rights, harm small businesses, and hinder data-driven innovation.

More than 130 countries have enacted general privacy protections, and five state legislatures have passed comprehensive data protection bills. However, for good reason, private right of action for privacy is not included in any of these states laws, nor is it part of the European Union’s General Data Protection Regulation.

The US Chamber of Commerce strongly urges Congress to pass durable, bipartisan national privacy legislation that protects all Americans equally. A national law should be enforced by the Federal Trade Commission with adequate funding and due process protections as well as state attorneys general. The Chamber, however will strongly oppose legislation that fails to provide meaningful preemption or any proposal that creates a blanket private right of action.

Succinctly, the US Chamber of Commerce wants a business-friendly federal privacy legislation.  Preemption is good for business.  Businesses would generally need to comply with the federal privacy laws rather than the current state by state approach.

A private right of action is not good for business.  A private right of action potentially opens the flood gates to privacy litigation.  The specific concern stated by Mr. Bradley is that a national data protection law with a private right of action would encourage an influx of abusive class action lawsuits.  He goes on to state that a private right of action for privacy is not included in the General Data Protection Regulation (GDPR).

However, Article 82 of the GDPR provides that the “data subject shall have the right to mandate a not-for-profit body … to lodge the complaint on his or her behalf.”  So, even though the individual doesn’t bring the suit individually, they can mandate applicable not-for-profit bodies to bring suits on their behalf.  These suits effectively always become class-action suits, as the not-for-profits operate in the public interest and essentially always have multiple aggrieved individuals.

Even though, the GDPR doesn’t have a private right of action, private individuals can initiate class-action suits.  The GDPR hasn’t caused a flood of class-action suits.

Another concern stated by Mr. Bradley is that a private right of action would harm small businesses.  Harming small businesses is a valid concern, but there are multiple ways to protect small businesses and the parsimonious way to protect small businesses is to specifically protect them rather than to modify an aspect of a law that applies to everyone because of the possibility that it will hurt small businesses.  As a matter of fact, the state privacy laws each utilize applicability criteria to minimize the number of small businesses to whom the law will apply.

Maybe a private right of action in a federal privacy law would be a mistake, but maybe it wouldn’t.  It also probably wouldn’t be as bad as Mr. Bradley indicated in his statement.

Nevertheless, the calls for federal privacy legislation are increasing, and I’d put my money on it happening eventually.  As privacy compliance becomes more and more necessary, it’s important to have reliable privacy compliance solutions at your disposal.  That’s where Clarip can help.  Clarip provides data privacy compliance services, including automated data subject request fulfillment, automated data mapping, website scanning, consent management, and vendor management.  Visit us at www.clarip.com or call us at 1-888-252-5653 to learn more.

Email Now:

Mike Mango, VP of Sales
mmango@clarip.com