Saikali Explores Possible Private Right to Bring Data Privacy Action

Shook Privacy and Data Security Chair Al Saikali has authored “The Coming Litigation Tsunami?: Why Private-Right-Of-Action Enforcement Undermines Privacy And Data Security” for the Washington Legal Foundation’s Legal Backgrounder. Saikali considers how a private right of action would affect data privacy litigation, concluding that the possibility “appears to benefit plaintiffs’ lawyers the most, imposes a significant burden on judicial resources, and creates a disincentive for companies to be more forthcoming about privacy incidents, which is antithetical to the purpose of these laws and harmful to consumers.”
Saikali examines the Illinois Biometric Information Privacy Act (BIPA) as a case study, noting that the decade-old law has been grounds for more than 200 class actions since late 2017. “The lawsuits contend that the defendants never gave employees notice that their biometric information was being collected, nor were they asked to sign a release as required by BIPA,” Saikali explains. “Companies that employ as few as 1,000 people are now facing a minimum of $1,000,000 in liability under these lawsuits.”
Saikali predicts that U.S. Congress “may take a more measured approach” because the biometric privacy law it is considering would not provide for a private right of action. “The Commercial Facial Recognition Privacy Act would, among other things, prohibit certain entities from using facial recognition technology to identify or track an end user without obtaining the affirmative consent of the end user,” he explains, but he notes that it would not preempt private rights of action created under state laws such as BIPA.
“As Congress considers a national data-privacy law, businesses should pay close attention to whether the law will include a private right of action, and whether the law will preempt existing state privacy laws that already provide a private right of action,” Saikali advises. “The cost of implementing systems and processes to comply with data-privacy laws is significant. If Congress were to add a bonanza for the plaintiffs’ bar, the impact on U.S. companies and judicial systems would be enormous.”