USA Law and Practice Contributed by: Aly Dossa and Marcus Burnside, Chamberlain Hrdlicka
state level, there are fewer agency bodies available and most actions are taken in lawsuits between the state and the affected organisation. Due to the patchwork framework of the US, the pro - cedural rules vary greatly based on which regulator is initiating an action. However, privacy laws are usually civil in nature, and thus these actions usually align with the local procedural rules. In addition, the penalties vary greatly by regulator, and review of a particular regulator is required to better understand what types of penalties are enacted, often including an agreement to remedy prior violations, take actions to prevent future harm, make recurring disclosures to regulators and payment of fines. 1.9 Enforcement Trends Significant Enforcement Actions (2023-2025) Recent enforcement activity has intensified and mon - etary damages have significantly increased. The FTC has aggressively pursued cases involving health and children’s data, including a USD10 million proposed settlement with Disney over COPPA violations, set - tlements with Cerebral (USD7 million) and GoodRx (USD1.5 million) for issues affecting health informa - tion with advertising platforms, and actions against Rite Aid for using facial recognition technology with - out adequate safeguards and accuracy testing. Bio - metric privacy enforcement has intensified under state laws, with BNSF settling a class action litiga - tion under Illinois’ Biometric Information Privacy Act (BIPA) for USD75 million. State attorneys general have increased co-ordinated multi-state investiga - tions and enforcement, with major actions including a USD391.5 million settlement with Google (40 states) for deceptive location-tracking practices. In addition, Texas has emerged as one of the strictest enforcers with the Texas Attorney General securing a USD1.4 billion settlement with Meta in 2024 and a USD1.375 billion settlement with Google, each for unlawful cap - ture and use of biometric data through facial recogni - tion features without proper consent. Emerging Trends In the past, US privacy law enforcement was largely left to federal agencies tasked with their domain- specific enforcement. However, recently, state level enforcement, beginning with California, and reaching
new highs in Texas, has significantly increased the breadth and scope of enforcement in the US. In addi - tion, many of these regulators are seeking more oner - ous operational penalties on organisations, restricting types of data they can collect and what they can do with certain data that exceed the statutory require - ments.
2. Privacy Litigation 2.1 Privacy Litigation Overview Dispute Trends
Litigation between private parties most often results from a data breach, which, as discussed in 1.6 Data Breach Requirement , includes plaintiffs filing class actions alleging negligence, breach of contract, breach of implied contract, unjust enrichment, viola - tions of state consumer protection statutes and vio - lations of state data breach notification laws. Other common lawsuits include: actions under the California Invasion of Privacy Act (CIPA) resulting from the use of certain online tracking tools on websites; and lawsuits in response to a Business Email Compromise (BEC) in which an attacker gains access to an email account and tricks customers or employees into sending mon - ey or sensitive information, often by changing pay - ment details or sending fake invoices. The potential damage model for each dispute is highly dependent on the underlying law and facts. For example, in a class action lawsuit resulting from a data breach, the damages are often a relatively small amount per person, but that amount is multiplied potentially millions of times, creating significant risk. In contrast, laws like CIPA provide statutory damages (ie, a set amount of damages per violation), which can also be multiplied many times to create significant risk. Further, suits based on a BEC are dependent solely on the amount of money wrongly sent. 2.2 Recent Case Law The patchwork system of the US means that the case law is highly specific to the particular governing law. In addition, most actions, particularly those brought by regulators, are settled before a case is even filed. As such, there is often a small body of case law, and
551 CHAMBERS.COM
Powered by FlippingBook