Class action and data privacy in the USA and Europe: Effective deterrent or ill-founded approach to compliance?

Abstract

The class action lawsuit: a term that strikes fear into boardrooms and among executive circles in the USA, and one that provokes strong reaction in Europe, mostly as a metaphor for a litigation culture run awry. Despite the bad press, however, the class action has its backers and European policy makers have increasingly come to accept its merits, notably its potential as a way to extend the arm of government-sanctioned authority and more generally to edge companies towards compliance. This paper focuses on class actions generally and specifically on data privacy class actions, which are but one litigation channel for a plaintiff to pursue when it comes to privacy violations (notwithstanding current trends for cyber security-related shareholder derivative suits). It begins by recapping the fundamentals of class actions in the USA, the historical roots, procedural aspects and current trends; it then turns to Europe, in particular to France. France offers a unique glimpse into how Europe, more generally, is attempting to leverage the benefits of class actions while avoiding the perceived negatives, most importantly by keeping lawyers at distance when it comes to initiating class actions. The paper will then cover a few other EU jurisdictions for comparison purposes and provide an overview of the most well-known privacy class action to-date — that introduced by Max Schrems.