Electronic Privacy Information Center

American companies and government agencies have promoted self-regulation as a way to establish and enforce privacy standards for the processing of consumer data. The first period of self-regulation dates from 1997 to 2007. Activities generally fell in three main categories: industry-supported, self-regulatory programs; government-sponsored, self-regulatory activities; and joint self-regulatory efforts. A new type of joint self-regulatory activity, the multi-stakeholder process, emerged in 2012 under the sponsorship of the Department of Commerce. Most industry-supported, self-regulatory programs failed in one or more substantive ways, and many disappeared entirely. These efforts tended to fade when pressure for regulation legislation diminished. The chapter concludes by suggesting some approaches to self-regulation that are more likely to produce more positive results.

The enforcement of rights is a critical requirement of privacy law. Absent actual enforcement, there is little meaningful incentive for companies to comply with privacy requirements. Enforcement also helps to ensure that the individuals whose privacy is placed at risk are fairly compensated. In matters involving a large number of consumers, providing a remedy to all users affected by a company’s practice is difficult and often times inefficient. For this reason, courts in the US provide for “class action litigation”, lawsuits brought on behalf of a large number of individuals in similar circumstances. The theory is that it is more efficient to merge all of the individual suits that might otherwise be brought. But class action litigation has its own shortcomings. Attorneys who represent the class members frequently settle these cases with the companies and agree to terms that provide benefits to the company, such as eliminating the possibility of all future lawsuits, and sacrifice the benefits that the individuals who they purport to represent might otherwise achieve. US courts are sensitive to the problem of collusion between the lawyers in class action settlements and have increasingly scrutinised these agreements to ensure that the settlements protect the interests of class members and are consistent with the purposes for which the lawsuit was brought. In the area of consumer privacy, the problem is particularly serious with class action attorneys increasingly trading the privacy rights of Internet users for their own private benefit. As a consequence, US consumer privacy organisations are challenging the settlements and turning to the Federal Trade Commission and others to block their adoption. In this article, the authors recommend that the US courts continue to closely scrutinise these agreements for fairness to the class members. Regarding the allocation of funds from such settlements, the authors propose that courts adopt objective criteria to ensure that the monies will be distributed for purposes that serve the interests of the class and are consistent with the reason for the litigation. The authors contend that these factors are the fundamental requirements for cy pres allocations.