Lawmakers in Florida and around the country are considering bills to protect your privacy. We support these efforts and have been working to make sure these laws provide meaningful privacy protections. But a privacy law only works if it can be enforced. While government enforcement is essential, today’s scope of data collection is simply too vast for a state’s Attorney General alone to regulate. People should be able to bring their own suits when a company violates their privacy rights. Private enforcement preserves the state’s resources, and the risk of litigation is a motivator for companies to comply with privacy laws.
The private right of action in the Florida House bill, HB 969, is the most important tool the legislature can give to Floridians to protect their privacy. Without broad enforcement, companies will assume there is a low risk of enforcement by the state. The effort that went into enacting a privacy law will be wasted, and large and powerful technology companies will continue to invade Floridians’ private lives, spy on their families, and gather their most intimate facts for profit. Private enforcement ensures that data collectors have strong financial incentives to meet their data protection obligations.
Private enforcement is not a new concept, nor is it one that large businesses are unaccustomed to dealing with. Many privacy laws have private rights of action, and these provisions have historically made it possible to hold companies accountable for their privacy violations. They include the Cable Communications Policy Act, the Video Privacy Protection Act, the Fair Credit Reporting Act, the Drivers Privacy Protection Act, and the Telephone Consumer Protection Act.
The damages set in privacy laws are not huge in an individual case. Still, they can provide a powerful incentive in large cases and are necessary to ensure that privacy rights will be taken seriously and violations are not tolerated.
The bill only applies to large companies with annual gross revenues over $50 million or data brokers. We realize that businesses don’t like to be sued, but the risk of lawsuits is a part of transacting in the real world. There are rules against frivolous suits, and meritless suits are dismissed quickly. The best way to avoid lawsuits is to comply with the law.
We commend the House of Representatives for standing up for Floridians and passing HB 969 with a private right of action by a 118-1 margin this week despite industry opposition. Unfortunately, the Senate Rules Committee removed a private right of action from the Senate privacy bill, SB 1734. We urge the Senate to restore this critical protection. Without it, Floridians will not have real, effective privacy protection.
This blog was first published in Tallahassee Democrat as an op-ed on April 23, 2021. You can view the original reporting at this link here.
Susan Grant is the Director of Consumer Protection and Privacy at CFA
Caitriona Fitzgerald is Deputy Director of the Electronic Privacy Information Center in Washington, D.C.