The U.S. Congress is currently considering a number of competing bills aimed at implementing a federal privacy law. Although the details of each proposal vary, such a law would have a profound effect on how an individual’s personal data may be used, shared and protected. Still, the specifics of a new federal privacy regime remain unclear.

According to the Brookings Institution: “Many questions, such as the size and type of entities covered; individual rights of access, correction, and deletion; enforcement; and pre-emption, will involve fundamentally political choices, but have technical and legal dimensions that may help or hurt the resolution of these political questions.”

Based on the text of the legislative proposals that are now being considered by Congress, it is unclear whether a federal privacy law will include a private right of action for the victims of a data breach. American Civil Liberties Union Senior Legislative Counsel Neema Singh Guliani believes consumers should have the right to sue companies that fail to adequately protect their personal information. "Huge privacy violations have become commonplace," she wrote. "Without a private right of action to sue, consumers have little practical ability to seek relief in cases where their data was mishandled or misused. This eliminates a powerful enforcement stick that can be used to dissuade companies from violating the law. A private right of action is also important because government agencies often do not have the resources to investigate and take action in every case where consumers’ privacy is violated. So, a private right of action may be the only avenue to hold a company accountable."

Many states, including Hawaii, Louisiana, Maryland, New Hampshire and Virginia, currently provide data breach victims with a private right of action to recover damages. Providing all individuals in the U.S. with a private right of action, however, comes with a caveat: There must be a carve-out for mandatory arbitration.  

Arbitration is often touted as more time- and cost-effective than traditional litigation. In many cases, this is true. In addition, parties to arbitral proceedings generally enjoy a level of confidentiality that simply doesn’t exist in the courts. Despite this, the statutory grounds for judicial review of an arbitration award are quite limited. Also, the company that writes the mandatory arbitration clause typically chooses the arbitral forum without regard for an individual data subject’s convenience.

In the U.S., there is an established federal policy favoring arbitration. Because of this, many companies choose to utilize a mandatory arbitration provision in order to avoid other federal laws. For example, in Epic Systems, the U.S. Supreme Court held the Federal Arbitration Act allows employers to use a mandatory arbitration clause that is included in an employment agreement to avoid class-action litigation despite the collective action protections specifically enumerated in the National Labor Relations Act. Without an arbitration exception, a private right of action for federal privacy law violations would be effectively useless for many data subjects.

Without an arbitration exception, a private right of action for federal privacy law violations would be effectively useless for many data subjects.

Avoiding data breach litigation via an arbitration clause is not a new phenomenon. For instance, Yahoo incurred a massive data breach in 2013. Many of the company’s customers were successfully able to pursue a class-action case against Yahoo. Four years later, Yahoo was acquired by Verizon, and the company immediately instituted an arbitration policy prohibiting collective action. This effectively bars Yahoo customers from pursuing a similar data breach claim against the business in the future.

To further illustrate, data breach lawsuits are regularly submitted to arbitration based on the arbitral provisions included in various customer contracts. A few recent examples include:

• The Northern District of Illinois ordered a would-be class-action lawsuit that was filed against Comcast to arbitration in February.
• Also in February, a federal district court in California issued an order compelling a proposed class-action data breach lawsuit that was filed against the parent company of popular smartphone app MyFitnessPal to arbitration based on an arbitral provision included in the app’s terms of use.
• Last September, the same California federal court ordered a collective-action lawsuit that was filed against ride-sharing app Uber to arbitration based on the company’s online service contract that also contained an arbitration provision.
• An Illinois federal judge ruled client data security claims that were filed against a Chicago-based law firm must be decided through individual arbitration.
• The Southern District of New York ordered a proposed class-action case that was filed over bookseller Barnes & Noble’s unauthorized disclosure of customer personal information to Facebook to arbitration.

Last month, the U.S. Supreme Court handed down its decision in a proposed class-action case that was filed against an employer following a data breach that disclosed the personal information of a group of employees. Although the main issue in Lamps Plus, Inc. v. Varela related to whether the workers were permitted to engage in collective arbitration based on the terms of an agreement to arbitrate, it was previously established the employees were not permitted to pursue a private right of action over the unauthorized disclosure of their personal data due to the mandatory arbitration clause each of the workers signed.

One thing is clear: A national data privacy law will lack teeth if it does not include a mandatory arbitration carve-out to ensure companies do not use such a provision to avoid any private right of action that is created by the new law.

Due to public support, as well as backing from technology companies, like Facebook, Google, Apple and Intel, 2019 may be the year the U.S. finally implements a much-needed comprehensive federal privacy law. What such a privacy regime will look like, however, is still the subject of much debate.

One thing is clear: A national data privacy law will lack teeth if it does not include a mandatory arbitration carve-out to ensure companies do not use such a provision to avoid any private right of action that is created by the new law. Although arbitration is a useful dispute resolution tool that should not be prohibited, it also should not be required. The victim of a data breach or other personal information disclosure should have the option to decide whether to utilize an arbitral forum to seek redress.

Photo by Wesley Tingey on Unsplash