Information holders no longer just have to worry about whether employees are disposing of data correctly—from domestic hackers to hostile foreign governments, cyberattacks have grown in number and in sophistication. As businesses work to navigate the evolving landscape, they find themselves bombarded by federal and state regulators using outdated laws, to plaintiffs seeking large settlements despite showing no actual injury from a data breach.
It is unclear for businesses what the scope of their liability is and to whom. The U.S. has a patchwork of federal laws intended to protect personal information. At the same time, states laws continue to evolve, imposing different (and sometimes contradictory) requirements for data privacy, including when and how victims of data breaches must notify their customers. Regulators have struggled to keep pace with the rising number of incidents and individuals’ concerns, with the result being a piecemeal, hastily-assembled legal regime.
A standard federal law governing breach notification requirements, preempting state laws, would provide much-needed predictability for businesses and protect them from abusive and overlapping enforcement. There is public support for this commonsense solution. Only those who are actually at risk or who have been harmed by a data breach should get notice or be able to sue.
Moreover, vague laws prohibiting unfair and deceptive practices, from Section 5 of the Federal Trade Commission (FTC) Act to similar state laws, are ripe for abuse; the FTC and some state attorneys general have broadly wielded them to go after businesses’ privacy and security practices. To make matters worse, individual and class action plaintiffs, led by the plaintiff’s bar, have jumped on the bandwagon as well.
It is important that privacy laws address real harms and actual injury and place reasonable limits on liability while discouraging meritless suits that simply take advantage of businesses. Holding businesses to impossible standards and allowing excessive and duplicative litigation hurts Americans and the economy.