In a concerning development for businesses, Republicans in Florida and Oklahoma showed support for a private right of action in pending data privacy legislation, with the Florida bill failing due to disagreement over the issue.
A private right of action in privacy legislation would be a boon for trial lawyers but is not the only effective enforcement mechanism for privacy legislation. Illinois’ Biometric Information Privacy Act, which has a private right of action, is an important case study. A flurry of lawsuits against businesses has prompted several bipartisan efforts to provide relief to employers.
Support for private right of action in Republican states:
- In Florida, the Republican State House passed a bill with a private right of action that is more expansive than the one found in California’s privacy law by a vote of 118-1. Thanks in large part to business community efforts, the Florida Senate opted for a different enforcement approach. The two chambers failed to reconcile their bills over disagreement on the issue.
- In Oklahoma, earlier versions of privacy legislation covered employment data and contained a private right of action. The Oklahoma bill also ultimately failed this session.
The recently-passed Virginia Consumer Data Protection Act, however, takes a different enforcement route. Violations of the law are enforceable by the state Attorney General. In addition, HR data is excluded from the scope of the measure. Democrats control both chambers of the Virginia General Assembly.
Federal deliberations picking back up: Sen. Jerry Moran (R-KS) reintroduced his Consumer Data Privacy and Security Act, which reflects congressional Republicans' positions on enforcement: namely, avoiding a private right of action. Sen. Moran's bill is far from the last one expected to be introduced this year.
The trend line in the states is concerning. Republicans and several Democrats in Congress have recognized the significant downsides of including a private right of action in federal comprehensive consumer privacy legislation. However, with some Republicans at the state level taking a different course, it will be incumbent on the business community to educate state officials about the impacts of comprehensive data privacy reform—which extend far beyond the tech giants.
