Breaking the Privacy Gridlock: A Broader Look at Remedies

Privacy and Security and Innovation and Economic Growth

Article Snapshot


James Dempsey, Chris Hoofnagle, Ira Rubinstein and Katherine Strandburg


Available at SSRN: or


Regulatory systems outside of privacy can serve as models for the enforcement of consumer privacy legislation. Regulatory oversight, self-regulation, and class action suits may be effective in enforcing privacy standards.

Policy Relevance

Environmental law may inform privacy enforcement, as it recognizes collective harms.

Main Points

  • The effort to pass federal consumer privacy legislation has been gridlocked by a conflict between two enforcement models, one based on private rights of action, and the other on federal preemption.
  • Regulatory systems outside of privacy such as financial services, environmental protection, and labor law, offer ideas for developing effective federal privacy enforcement systems.
  • The dominant “supervision” model of regulation in the U.S. requires government overseers with routine access to information about regulated entities to monitor the entities’ activities; by contrast, the Federal Trade Commission relies mainly on lawyer-led investigations.
  • The supervision model coincides with two key developments, a growing emphasis on public-private cooperation, and the growth of compliance departments within corporations.
  • Effective policy enforcement also often includes required information disclosures, which can encourage private actors to develop market-based solutions to problems voluntarily.
  • Environmental law addresses small, collective, and intangible harms.
    • Statutes set baseline requirements such as admission limits.
    • Penalties include administrative orders and civil actions for injunctive relief and monetary penalties, so individual plaintiffs need not sue.
    • Emission fees support market-based regulation.
    • Measures of damages include methods for assessing collective and intangible harms.
    • Citizen suits allow individuals to sue any entity that violates environmental standards, or to sue the Environmental Protection Agency for failure to perform required duties.
  • Regulatory systems often rely on private entities such as certification bodies and self-regulatory organizations; in finance, large financial institutions monitor third-party service providers.
  • Studies show that class action suits brought by consumers can deter wrongdoing, especially when consumers receive monetary damages.

Get The Article

Find the full article online

Search for Full Article