Several leading members of Congress just introduced legislation to protect Americans’ consumer data from misuse and abuse.
Unfortunately, the American Data Privacy and Protection Act, sponsored by Sen. Roger Wicker, R-Miss., and Rep. Frank Pallone, D-N.J., and Rep. Cathy McMorris Rodgers, R-Wash., contains significant defects unrelated to much-needed privacy protections for consumers or businesses. Instead of simply safeguarding the personal information of ordinary Americans and simplifying legal obligations for companies, the bill in its current form would also uncork a torrent of counterproductive lawsuits that would damage job creators and enrich trial lawyers.
There’s no question that America needs a federal data privacy law. Due to the lack of a uniform federal standard, data privacy is governed by a patchwork of state laws and regulations. Consequently, American firms may needlessly spend up to $1 trillion over the next decade trying to navigate that legal maze and comply with the varying statutes — with $200 billionof that burden falling on small businesses less capable of affording those legal costs.
A single, streamlined federal law would also help reassure consumers that their data remains secure, regardless of where they live or where a company is located. According to a recent Pew survey, more than half of Americans have declined to use a product or service because of privacy concerns.
The legislation under consideration, however, contains two massive flaws that would likely unleash endless class-action litigation over minor or technical violations, allowing lawyers to reap millions. At the same time, class members receive just a few dollars or, in many cases, nothing at all.
First, the proposed legislation includes a ban on class-action waivers in arbitration agreements, which could prohibit companies and consumers from having their disputes resolved individually. Arbitration offers a more efficient alternative to court litigation, relying on independent third parties to mediate conflicts. Essentially, the parties in the dispute take their issues to a neutral party, present their respective arguments, and agree to abide by whatever the arbitrator decides.
Although lawyers are understandably loath to admit it, arbitration is generally better for consumers than costly traditional court litigation. It is typically cheaper, quicker and less complicated than formal lawsuits. Consumers prevail 41 percent of the time in arbitration versus 29 percent in court. Additionally, awards in cases decided by arbitration actually exceed courtroom awards, $80,000 versus $71,000, respectively. Arbitration cases are also resolved 27 percent more quickly on average, and there’s often no need to involve — and thus pay — a lawyer.
Naturally, however, those benefits present big problems from lawyers’ perspectives. They prefer huge, class-action lawsuits that, according to a 2015 Consumer Financial Protection Bureau study, net consumers an average of $32 while lawyers earn close to $1 million.
As a second massive flaw as drafted, the bill creates a “private right of action,” which allows individuals to sue to enforce the law no matter how trivial the violation. When numerous individuals can file the same complaint, plaintiffs’ lawyers try to lump them all together and get their cases certified as a class in one big lawsuit against a business — even if most of the people in the class are unaware that they’re even part of a lawsuit. While it’s perfectly clear how that benefits lawyers, what it might do to truly advance consumer privacy and data protection is uncertain.
As past experience demonstrates, creating a private right of action leads to a morass of excess litigation. In the 1990s, as one example, Congress tried to sic the plaintiffs’ bar on “unscrupulous scam telemarketers” by creating a private right of action. Lawyers instead went after legitimate businesses over technicalities — because those businesses, not fly-by-night scammers, were the ones with deeper pockets to pay massive settlements, an enormous proportion of which went to lawyers rather than alleged victims.
Data security and privacy remain serious, complex issues and Congress should absolutely pursue a uniform national policy. People who steal our data, and businesses that fail to adequately protect it, must be held accountable.
As drafted, however, the American Data Privacy and Protection Act contains unacceptable provisions enabling rich trial lawyers to get even richer while delivering scant benefits to ordinary Americans whose interests they claim to represent.
