The new age of data protection laws began on May 25, 2018, with the passing of the EU’s General Data Protection Regulation (GDPR) law. The GDPR is a comprehensive data privacy and security law that established a strict framework for the collection, processing, storage and transfer of personal data from EU citizens. One interesting aspect of the GDPR is that it extends beyond the EU’s borders, meaning that any organization that collects EU consumer data is subject to the law — even those companies that are outside the EU.

The GDPR, the CCPA and more

At the federal level – The ADPPA

The Private Right of Action

One consumer right included in the ADPPA (so far) is a Private Right of Action. This right ensures that consumers can sue companies directly for some violations of the ADPPA — instead of waiting for a government agency to sue the offending organization.

The violations included in the Private Right of Action include:

• Unauthorized access or disclosure of personal information
• Failure to implement reasonable security measures to protect personal information
• Collection or use of personal information without consent
• Sale of personal information without consent
• Discrimination against consumers who exercise their privacy rights

Consumers who sue under the ADPPA can seek damages, injunctive relief and other remedies.

There are several new state data privacy laws, which include variations of the Private Right of Action (at the time of this writing).

These state laws include:

• California Consumer Privacy Act (CCPA)/California Privacy Rights Act (CPRA)
• Colorado Privacy Act (CPA)
• Connecticut Data Privacy Act (CTDPA)
• Utah Consumer Privacy Act (UCPA)
• Virginia Consumer Data Protection Act (VCDPA)

The specific provisions that a particular state's Private Right of Action covers will vary from state to state. Consumers in states without a Private Right of Action may still be able to file complaints with their state attorney general or other regulatory agencies; however, they will not have the ability to sue offending companies directly.

The ADPPA's Private Right of Action is limited in scope. Individuals can only sue companies for violating specific law provisions (listed above). Additionally, individuals would first need to notify the Federal Trade Commission (FTC) of their intent to sue. The FTC would have the authority to intervene in the lawsuit if they choose to.

The inclusion of a private right of action in the ADPPA is a significant development in data privacy law. It gives individuals a powerful tool to hold companies accountable for mishandling their personal data. However, the limited scope of the private right of action means that it may not be effective in all cases.

The ADPPA's Private Right of Action is a complex legal provision and is a hot-button issue for many federal legislators.

The ADPPA preemption provision

The ADPPA includes a preemption provision that would override many state data privacy laws, including CCPA and CPRA. This has been a controversial issue, with some consumer advocates arguing that preemption would weaken consumer privacy protections and others arguing that it is necessary to create a uniform and less complex national data privacy law.

The preemption provision means that state laws that cover the same topics as the ADPPA — such as data collection, use, and disclosure — would be preempted and unenforceable. The preemption provision was a major priority for organizations. It would (in most cases) mean that instead of having to track and comply with an expanding state data privacy law landscape, organizations would only have one U.S. data privacy law to follow. This would drastically reduce the complexity and cost of data privacy compliance.

However, the state of California raised objections to this provision, and because the Speaker of the House at the time was from California, the ADPPA was not brought to the floor for a vote.

Will the Federal Trade Commission step in?

Additionally, because of the lack of a federal data privacy law, the FTC has provided guidance that it will begin adopting regulations and enforcement that focus on consumer data privacy and data security.

The FTC has been a long-time vocal advocate for data privacy law regulations and enforcement. The FTC has stated that data privacy is now a top priority and will use all its tools to protect consumers from unfair and deceptive data privacy practices.

The FTC has issued several guidance documents on data privacy law enforcement. In 2016, the FTC issued a report on the data privacy practices of companies in the mobile app ecosystem that found companies were collecting and using sensitive consumer data without obtaining proper consent. The FTC also issued a report on the data privacy practices of data brokers, which found that data brokers collected and sold a wide range of personal data about consumers without consumers' knowledge or consent.

Recently, the FTC has taken numerous enforcement actions against companies for data privacy violations. For example, in 2019, the FTC settled a case with Facebook for $5 billion for violating users' privacy. The FTC alleged that Facebook misled users about how their data was being used and that the company allowed third-party app developers to access user data without permission.

Consumer advocates have praised the FTC's data privacy law enforcement efforts. However, some businesses have criticized the FTC for being too aggressive in its enforcement actions.

A positive sign many are waiting to see in the evolving privacy policy challenge would be for the FTC to open a privacy rulemaking push under its Section 18 authority to establish binding privacy Federal regulations for all the industries under its jurisdiction.

Current FTC Chair Lina Khan and Commissioner Rebecca Slaughter have already indicated they favor this approach. The agency has twice provided notice of its intention to proceed with privacy rulemaking. With the recent addition of privacy advocate Alvaro Bedoya as a third vote, the commission could soon move ahead with this agency regulatory approach.

What does the future hold?

The outlook for the passage of the ADPPA is still uncertain. Despite the challenges, there is a chance that the ADPPA could be passed in the next Congress. The Biden administration has expressed support for the bill, and there is bipartisan support in Congress. However, it is possible that the legislation could be delayed or even derailed by other legislative priorities.

There is little doubt that a U.S. federal data privacy law will eventually be passed. But until then, companies that collect, store, sell or use PII will face an increasingly complex and risky regulatory landscape.

Organizations that harvest PII would be well advised to take all data privacy laws seriously and ensure their C-Level management and boards are made aware of the liability and the need to spend additional funds to reduce the overall risk. The fines issued to organizations for non-compliance could potentially put many companies out of business.

FEATURED BRIEF

Taking on the Challenge of Mobility for Financial Services

Webinar Brief

Read Now