Federal Geolocation Bills Differ on Scope and Damages (Guest Blog Post)
By Sonya Ziaja
[Sonya is an American attorney and MSc. candidate at University of Oxford. She writes regularly for LegalMatch and Shark. Laser. Blawg.]
Congress will be considering at least two geolocation privacy bills this term. The bipartisan Geolocation Privacy and Surveillance Act (“GPS Act”) tries to tackle both the Fourth Amendment problems with law enforcement’s widespread unwarranted use of GPS as well as the pesky consumer privacy issues with data collection. Senator Al Franken’s Location Privacy Protection Act separates those issues, and focuses instead only on consumer privacy.
The GPS Act’s comprehensive approach to geolocation privacy is admirable. But, in its attempt to regulate such disparate actors as the F.B.I. and Apple, the bill looks like it bit off more than it could chew and lost some teeth—especially with regards to consumer protection. A comparison of the bills highlights a weakness in the GPS Act’s enforcement mechanism.
In both bills, enforcement means litigation. Both bills allow for a private right to civil action against non-government entities and individuals that intercept, use or disclose geolocation information. Both bills also provide for equitable relief. So, under either bill, you could sue to stop an entity from collecting or selling your geolocation information. And both bills include a fee-shifting provision, so hiring an attorney shouldn’t be too much of a barrier to seeking relief. There are significant differences, though, in how damages are calculated and the limitations on relief in the bills.
On the surface, the GPS Act’s remedies appears stronger. It gives courts two options to assess damages and instructs the courts to use the greater of the two. Either the plaintiff is awarded actual damages plus any profits the offending party gained through the violation; or the plaintiff is granted statutory damages of $100 a day for each day of violation or $10,000, whichever is greater. The first option seems unlikely to act as a deterrent, unless the case is brought as a class action suit, or the individual was in a unique position to lose money from having their location known. So for an ordinary individual bringing suit, statutory damages likely make the most sense under this plan. Successful plaintiffs are guaranteed a minimum $10,000. In addition a plaintiff can sue for punitive damages in “appropriate cases.” What exactly constitutes an “appropriate case” is not described in the bill and is left to the courts to decide.
The Location Privacy and Protection Act takes a more modest and straightforward approach. Potential damages include actual damages (assuming they’re beyond a $2,500 threshold) and punitive damages. So an ordinary individual plaintiff could get less under this bill than the $10,000 minimum in the GPS Act.
But while the GPS Act provides for potentially steeper penalties than the Location Privacy and Protection Action, it also contains significant barriers to bringing a successful suit. Chief among these is its statute of limitations. It requires that a plaintiff bring a case within “two years after the date upon which the claimant first has a reasonable opportunity to discover the violation” or the plaintiff loses the right to bring a suit. In other words, if you fail to realize that an entity is intercepting, using or distributing your geolocation information, you’re in danger of losing your right to sue and stop that entity from continuing to track you.
The statute of limitation in the Location Privacy and Protection Act is more reasonable. It’s still a two-year limit, which would protect corporations from unanticipated lawsuits far into the future. But, where the GPS Act starts the two-year count from the moment that you could have possibly known you were being tracked, this bill starts the two-year count from the date the violation actually happened or the date that you actually learned the violation had taken place.
The GPS Act does take positive steps to protect citizens’ privacy rights from law enforcement. But from the point of view of the bill, when those same citizens are viewed as consumers, their privacy no longer seem to be as much of a concern. I would hope that the barriers to enforcement included in the GPS Act are simply oversights and will be remedied in future versions of the bill. Absent changes, however, Franken’s Location Privacy Protection Act looks to be the better bet for protecting consumer privacy rights. You might not get the same returns on it as you might from the GPS Act, but at least you have a better chance of being able to sue to stop companies from surrepticiously tracking you.