The first week of May marks National Small Business Week where we recognize the important role small businesses play in the retail industry. In fact, 98% of retailers are small businesses. However, amidst this celebration, a looming threat hangs over Main Street as Congress considers the American Privacy Rights Act (APRA).
Tell Congress to protect small businesses from “drive-by” lawsuits.
The APRA includes a private right of action provision that authorizes “drive-by” lawsuits targeting small businesses for choosing business partners who might violate the law, rather than permitting lawsuits against these partners for their own violations and holding them accountable for failing to protect consumers’ privacy. The lawsuits retailers will face under the proposed APRA will be like the “drive-by” lawsuits seeking quick settlements that business owners have struggled with under the Americans with Disabilities Act (ADA). Shifting liability for violations onto small business owners will ultimately not make American’s data more secure—instead it will harm small businesses and kill job growth on Main Street.
This sweeping privacy legislation is being marketed as a solution to address the public’s concerns over data privacy, but it disproportionately impacts small businesses exposed to these lawsuits while shielding major tech giants and data solutions providers from litigation.
If the APRA becomes law, the private right of action would allow opportunistic trial lawyers to sue small businesses for the privacy or security violations of their vendors over which they have no direct control. Small businesses must sign take-it-or-leave-it contracts from vendors for necessary services and cannot exercise real control over how their vendors conduct business. Retailers rely on service providers for essential business functions, like website development, internet services, marketing, social media, and data management solutions; however, these service providers regularly face investigations for security breaches and privacy violations.
After the ADA was enacted, Main Street has faced a significant rise in lawsuits for alleged ADA violations. Trial lawyers target small businesses who may be unaware of any ADA violations, seeking quick settlements due to the small businesses’ limited capital and legal resources to properly defend themselves. In fact, these predatory practices have increased 320% since 2013. If the APRA is passed with a private right of action, Main Street businesses can expect to face the same aggressive litigation tactics from greedy and opportunistic trial lawyers.
The APRA will restrict the ability of retailers to grow their businesses by attaching legal peril to using services to improve their marketing reach. Responsible use of consumer data is at the core of Main Street businesses’ relationship with their customers. Knowing which customers may be most interested in certain offerings or communications is essential to their success when they share new products, offer rewards, improve service, or place ads to attract new customers. Retailers take great care to cultivate long-time relationships with customers to better serve them, which in turn increases sales.
Since small businesses could face lawsuits for the privacy violations of marketing service providers they choose to reach consumers, the risk of engaging in any marketing services increases and could significantly limit their growth. In essence, small businesses cannot grow and expand if they cannot market their products to consumers because the potential legal exposure from engaging in marketing is too great a risk to take on.
Imagine the grand opening of a new small business in your community. How will that business attract potential new customers and grow their revenue if they cannot leverage the full range of data-driven solutions offered by service providers to advertise and market to those consumers who may be most interested in their new business and coming to visit their store?
Retailers support a national data privacy law that establishes protections for consumer data in a consistent manner. We believe any privacy law should make all businesses responsible for their own conduct and should not expose them to liability for privacy violations by their service providers. Join NRF in calling on Congress to fix the APRA and remove the private right of action provision by participating in our grassroots campaign.