Washington Privacy Act’s Fight for a Private Right of Action

  Washington was one of the first states to follow in CCPA’s footsteps to pass a comprehensive consumer privacy law. However, as other states have been gaining steam with their copy-cat consumer privacy legislation, Washington’s Privacy Act has been stranded in legislative limbo, primarily due to the lawmakers’ clashes over a private right of action.

  In 2019, the dispute over a private right act of action provision was the reason behind the initial failure of the Washing Privacy Act. In 2020, the lawmakers tried again. The Washington House Innovation, Technology & Economic Development Committee voted to pass a strengthened version of the Washington Privacy Act, adding a private right of action into the second iteration of the bill.¹ However, after a promising start following the law’s proposal in the Senate, the 2020 version of the Washington Privacy Act also failed to pass after the Senate refused to accept amendments, that included a private right of action, made by the House of Representative.² Sen. Reuven Carlyle, D-Wash, credited the Act’s enforcement mechanism as a key point of disagreement between the House and Senate, which ultimately led to the 2020 law’s demise.³

Washington Privacy Act 3.0: PRoA debate so far

  On February 8, 2021, the Washington State Senate Ways & Means Committee debated a third version of the Washington Privacy Act (“WPA”).⁴ At that time the WPA did not provide a private right of action for consumers, but the Office of Attorney General Legislative Director, Yasmin Trudeau, indicated that a lack of private right of action was a hurdle that the agency hoped to resolve going forward.⁵

  On March 26, 2021, the WPA passed the House of Civil Rights and Judiciary Committee, with amendments that incorporated a limited private right of action.⁶ As currently amended, the Act would allow consumers to seek injunctive relief, and recover attorneys’ fees in a successful court action for violations of the WPA.⁷ The Act’s private right of action provision is limited in that it does not provide statutory or actual damages to the consumers and limits consumers’ right to sue under two sections of the Act: the consumer rights section and the anti-descrimination section.⁸ As in previous sessions, WPA’s private right of action remained a hotly debated and controversial topic. The Legislative Director for the Washington Attorney General’s Office, Yasmin Trudeau, stated that the Office of Attorney General believes in the Act’s private right of action “as a policy matter.”⁹ In her comments, Trudeau highlighted the importance of giving individuals the ability to enforce their privacy rights.¹⁰ Proponents of the private right of action, including the American Civil Liberties Union and the Electronic Frontier Foundation, agree that the provision allows the law to have some “teeth” in terms of its enforcement.¹¹ Critics, on the other hand, claim that a private right of action will open floodgates of legal actions without effectively improving consumer privacy.¹²

A look at current PRoA legal landscape

  Privacy legislation is no stranger to private right of action provisions. Presently, 17 states, including Washington, permit a private cause of action in data breach violations.¹³ Several consumer protection federal laws - like the TCPA, FCRA, and VPPA - provide a private cause of action, and most recently, state consumer privacy statutes, such as CCPA and BIPA joined this list as well.¹⁴

  The effect of these private right of action provisions has primarily been the advent of class action litigation. Although the awards of successful class actions and settlements are often high, whether these awards adequately compensate consumers for the violation of their privacy rights is at best questionable. Sometimes, due to the number of consumers, the amount to be awarded to the class members is trivial compared to the fees received by plaintiffs’ attorneys in the case. Critics of the private right of action are then left wondering whether plaintiffs’ attorneys or the litigants/consumers are the real winners of consumer privacy cases.

  For example, in 2020 Facebook settled a BIPA action for $650 million.¹⁵ Class members were expected to receive $200 - $400 each. Class counsel was awarded $97.5 million in attorneys’ fees.¹⁶ Also in 2020, an Alabama judge awarded $8.75 million in attorneys’ fees in a TCPA class action suit brought against a domain registration and web hosting services company, GoDaddy.¹⁷ Individual class plaintiffs received $35 payments or a $150 voucher with the company.¹⁸ These outcomes beg the question, whether expensive class litigation and staggeringly high settlements actually disproportionately benefit plaintiffs’ lawyers rather than individuals whose privacy interests may have been infringed. After all, the american civil justice system is based on the premise that damages are awarded to make the plaintiff whole, not to punish the defendant. Unlike, fines, which carry a deterrent effect.

  In some instances, however, when it comes to monetary awards, everybody loses. Take for example, a pending settlement of the recent CCPA action against Hanna Anderson and Salesforce.¹⁹ In February and March of 2019, three class actions were filed against a children’s clothing company, Hanna Anderson, and a third-party e-commerce platform, Salesforce.com in connection with a data breach suffered by the companies in fall 2019.²⁰ The three actions with approximately 200,273 class members were consolidated and in December 2020, the court preliminary approved a class action settlement that was agreed upon between the parties.²¹

  As part of the settlement, Hanna Anderson is required to improve its cybersecurity measures and pay $400,000 into a settlement fund (amounting less than $2 per class member).²² Although the settlement fund is meant to provide cash payments of up to $500 per class member and up to $5,000 in extraordinary circumstances, such as fraud or rampant identity theft, the ultimate payout is expected to be approximately $38 per class member.²³ The defendants also agreed to pay $120,000 in attorney fees.²⁴ While $120,000 in fees is a substantial amount, considering the parties settled at the pleadings stage of the case, counsel claims to have incurred more than twice that amount based on the time and costs invested in the case, which seems likely given that multiple firms were involved. It is unlikely that such an award will make the plaintiffs whole or fairly compensate plaintiffs’ attorneys that have worked on this case. Such nominal awards seem to have a merely punitive effect on the defendants, which is not the intent behind the creation of a private right of action in privacy statutes, as a matter of policy.

  In the case of TCPA and BIPA, the class action lawsuits led to a push for reform to curb possible lawsuit abuse and contain the flood of class actions. In 2017, in a push to reform the TCPA, the U.S. House Judiciary Committee’s Subcommittee on the Constitution and Civil Justice held a hearing on “Lawsuit Abuse and the Telephone Consumer Protection Act”.²⁵ Some of the topics discussed at the hearing included the need to bring the 1991 legislation up to date with new and evolved technologies, curbing the negative impact of the legislation on small businesses that fear multi-million adverse rulings but may have difficulties complying with the outdated law due to the ambiguities in the statute and inconsistencies in district-by-district court rulings.²⁶ Although at the time, Chairman Goodlatte recognized that “something” had to be done to reform or update the TCPA, no reform was subsequently passed.²⁷

  Efforts to reform BIPA seem more promising. On March 9, 2021, a proposal to reform BIPA was passed in the House Judiciary-Civil Committee in a bi-partisan vote of 10-5-1.²⁸ The proposal to reform the law was a direct response to thousands of lawsuits filed under the BIPA’s private right of action provision.²⁹ If passed, the proposed measure will allow for a 30-day time period to correct alleged violations of the Act, as well as actual damages (rather than liquidated damages) for the negligent and willful offending entity.³⁰ It will also exclude employees of private entities from bringing legal action if a collective bargaining agreement that addresses biometric information is in place.³¹

WPA’s PRoA - to be or not to be?

  There was a lot of hope that third time will be the charm for the WPA, due to the industry support it received earlier on in the legislative session. Contrary to what seems to be the popular opinion, the tech giants are not generally opposed to consumer privacy regulation. Both Microsoft and Amazon, for example, supported the recently passed Virginia Consumer Privacy Act.³² An earlier iteration of the WPA also received support from Amazon and the Washington Technology Industry Association.³³ The Electronic Frontier Foundation (“EFF”), a non-profit digital rights group, however, believes that the tech giants are in favor of promoting a law like the WPA, specifically because of its weaknesses and inability to change the privacy landscape in favor of consumers in any meaningful way.³⁴ Beside the lack of a private right of action, the EFF also criticized the Washington Privacy Act for being too business-friendly and for its lack of other consumer protection mechanisms such as a global opt-out option for targeted advertising, narrow definitions of “sale” and “personal data” and lack of transparency of companies’ risk assessments.³⁵

  Based on WPA’s predecessors, it is at best unclear that a private right of action will provide any real rights or relief to consumers. Some lawmakers and consumer advocacy groups seem to believe that a private right of action provision is the only way to give the law “teeth”. This belief, however, may just lead to another death of the WPA in the Senate, as the stark divide across the party lines that led to the death of the first two iterations of WPA persists during this term. Although it is possible that lawmakers will agree to a very narrowly tailored private right of action or pass the bill with the intent to further amend it down the line, similar to the CCPA, this is a highly optimistic outcome for the current version of the bill. If the Act fails to pass once again, however, perhaps the 4.0 version of the law will find a way to provide consumers with more protection and strong agency enforcement mechanisms, without inundating businesses with the potential for class action suits, bearing a punitive rather than a restorative effect.

4/13/21 Update: The bill failed to receive a House vote by an April 11, 2021 deadline for action on non-budget policy bills. Sen. Reuven Carlyle, D-Wash., said he believes “the bill remains alive through the end of the legislative session,” but did not provide any other insight. The legislative session ends on April 25, 2021.