May 07, 2021
In a concerning development for businesses, Republicans in Florida and Oklahoma showed support for a private right of action in pending data privacy legislation, with the Florida bill failing due to disagreement over the issue.
A private right of action in privacy legislation would be a boon for trial lawyers but is not the only effective enforcement mechanism for privacy legislation. Illinois’ Biometric Information Privacy Act, which has a private right of action, is an important case study. A flurry of lawsuits against businesses has prompted several bipartisan efforts to provide relief to employers.
Support for private right of action in Republican states:
The recently-passed Virginia Consumer Data Protection Act, however, takes a different enforcement route. Violations of the law are enforceable by the state Attorney General. In addition, HR data is excluded from the scope of the measure. Democrats control both chambers of the Virginia General Assembly.
Federal deliberations picking back up: Sen. Jerry Moran (R-KS) reintroduced his Consumer Data Privacy and Security Act, which reflects congressional Republicans' positions on enforcement: namely, avoiding a private right of action. Sen. Moran's bill is far from the last one expected to be introduced this year.
The trend line in the states is concerning. Republicans and several Democrats in Congress have recognized the significant downsides of including a private right of action in federal comprehensive consumer privacy legislation. However, with some Republicans at the state level taking a different course, it will be incumbent on the business community to educate state officials about the impacts of comprehensive data privacy reform—which extend far beyond the tech giants.