I just posted my new article draft on SSRN (free download): Enforcing Privacy Law: Why Private Litigation Is Essential.
Here’s the abstract:
Enforcement is an essential dimension for effective privacy and data protection laws—and it is probably the most important one. No matter how many privacy laws are enacted and how strong the laws are, if enforcement falls short, the laws will fail to achieve their goals. Unfortunately, the enforcement of privacy laws is often weak and inadequate, a plague that renders them infirm.
This Article addresses a gap in the academic literature about privacy law, as enforcement is undertheorized. Only a few articles have addressed enforcement in depth, and these pieces have focused on specific laws and types of enforcement; they have not explored the whole picture. Enforcement is an essential issue, as it is not possible to evaluate a privacy law meaningfully without considering how it will be enforced in practice. Policymakers, however, often neglect to reckon with the practicalities of enforcement, resulting in laws that are ineffective.
This Article makes four primary arguments. First, the effectiveness of privacy laws depends upon enforcement, and poor enforcement can neuter even a strong law. The enforcement of privacy laws is currently quite weak.
Second, government enforcement has many substantial shortcomings that undermine its effectiveness. Government enforcement requires far more resources, insulation from political interference, consistency, and potency. Even with considerable improvement, there ultimately will be a ceiling. In most cases, government enforcement will never be nearly enough.
Third, enforcement is about incentives. Far too often, the incentives are poorly aligned for organizations to follow the law. Government enforcement is rarely sufficiently dissuasive. The risk equation comes out heavily in favor of non-compliance or poor compliance because penalties are not severe or frequent enough to outweigh the benefits of noncompliance.
Fourth, enforcement from multiple enforcers and enforcement mechanisms works best, and private litigation is an essential part of the enforcement equation, adding dimensions to enforcement that government enforcement lacks. Only with an understanding of the overall landscape of enforcement can the virtues of private litigation be fully appreciated.
Professor Daniel J. Solove is a law professor at George Washington University Law School. Through his company, TeachPrivacy, he has created the largest library of computer-based privacy and data security training, with more than 180 courses.
Subscribe to Solove’s Free Substack
A supplement to Solove’s regular newsletter with more in-depth discussions
