Enforcement of Privacy Laws We live in a world in which the digital age has transformed our understanding of privacy, as well as brought on additional challenges to protecting privacy.

We tend to think of the right to privacy too narrowly. We think we can still choose whether to download an application or share data online. But we are often forced to trust others with our data. Think about how often you use a credit or debit card to purchase something at a gas station, grocery store, or online. Each time you do, you trust that business to secure your personal data.

What should happen when that business fails to properly secure that data? In some cases, a state Attorney General's office will take action, bring a lawsuit, and impose penalties against the business. Should the consumers also have a private right of action to bring suit against the business? Should they be able to bring class action lawsuits in those circumstances?

When we think of privacy issues, we usually mainly focus on companies like Facebook, Instagram, and Google. However, all companies collect data about us as consumers. If you stop at a convenience store to fill up your car with gas, that store collects data about you from the store's security cameras and from your credit or debit card. The information from the cards you use for payment is particularly valuable to fraudsters, as it can be used to access your funds and personal information about you. Most people tend to recycle codes and passwords, so the pin code you enter into the keypad at the gas pump may be used on other bank accounts, as a password on an email address, or a garage code at someone's home.

So, what happens when a business stores that information, but does not secure it properly, leaving it vulnerable to hackers? The State Attorney General's office can bring an action against the business on behalf of that state's consumers. On the Federal level, the Federal Trade Commission (FTC) can bring an action as well. But should individual consumers whose data is compromised be able to bring suit as well? If their data has not actually been used in any fraudulent way, how should their damages be calculated?

How did the right to privacy evolve? Does it do a sufficient job of protecting our personal data and rights? Discuss the private right of action - who should litigate the issues noted in the scenario and bring the claims? Should it be the government or the affected parties? Explain why. Should the supermarket be held liable or accountable for the data breach? Why or why not? Are the penalties sufficient for the parties involved? Should there be higher fines or longer jail times? Explain the ethical and practical considerations surrounding data breaches and data protection in the scenario. How do privacy laws address these concerns?