Enforcement of Privacy Laws

We live in a world in which the digital age has transformed our understanding of privacy, as well as brought on additional challenges to protecting privacy.

We tend to think of the right to privacy too narrowly. We think we can still choose whether to download an application or share data online. But we are often forced to trust others with our data. Think about how often you use a credit or debit card to purchase something at a gas station, grocery store, or online. Each time you do, you trust that business to secure your personal data.  

What should happen when that business fails to properly secure that data? In some cases, a state Attorney General’s office will take action, bring a lawsuit, and impose penalties against the business. Should the consumers also have a private right of action to bring suit against the business? Should they be able to bring class action lawsuits in those circumstances? 

When we think of privacy issues, we usually mainly focus on companies like Facebook, Instagram, and Google. However, all companies collect data about us as consumers. If you stop at a convenience store to fill up your car with gas, that store collects data about you from the store’s security cameras and from your credit or debit card. The information from the cards you use for payment is particularly valuable to fraudsters, as it can be used to access your funds and personal information about you. Most people tend to recycle codes and passwords, so the pin code you enter into the keypad at the gas pump may be used on other bank accounts, as a password on an email address, or a garage code at someone’s home.  

So, what happens when a business stores that information, but does not secure it properly, leaving it vulnerable to hackers? The State Attorney General’s office can bring an action against the business on behalf of that state’s consumers. On the Federal level, the Federal Trade Commission (FTC) can bring an action as well. But should individual consumers whose data is compromised be able to bring suit as well? If their data has not actually been used in any fraudulent way, how should their damages be calculated?