Last Tuesday I gave the model act its first set of teeth: suppression. But suppression has a blind spot so large it swallows most of the people the Act is supposed to protect. Suppression is a defendant’s remedy. It lives inside a prosecution. You file a motion, the judge excludes the evidence, the case weakens or collapses. That is enormous leverage — if you are the one being charged with a crime. If you are not, suppression is a locked door with no handle on your side.
And here is the thing about the digital rules I’ve spent nine weeks drafting — the collection limits, the retention clock, the analysis restrictions, the use-and-disclosure bar, the disposition duty. The people against whom those rules are most often broken are not defendants. They are the bystanders whose phones were swept into a geofence that happened to draw the wrong block. They are the account-holders whose non-responsive data was imaged and then kept for six years against a case that was never about them. They are the Americans whose communications sat in a database and got queried without a warrant. The overwhelming majority are never charged. Most never find out. For every one of them, suppression offers precisely nothing — there is no case in which to suppress anything. And even for the person who is charged, suppression only keeps the evidence out of a trial. It does not undo the years of retention, the re-searches, or the disclosure. The harm to the citizen and the remedy for the defendant are not the same thing.
So the model act needs a second remedy, pointed at the harm itself and available to the person regardless of whether anyone ever prosecutes them. In Title III, that remedy is § 2520: a civil cause of action for a person whose communications were unlawfully intercepted, disclosed, or used — actual damages or a statutory floor, punitive damages in the right case, and attorney’s fees. It does not require you to be a criminal defendant. It requires only that you were wronged. That is the model.
But notice where the blueprint flinches, because it is exactly the seam § 10 has to weld shut. Title III’s civil action runs against “the person or entity, other than the United States, which engaged in that violation.” The federal government wrote itself out of its own damages remedy. Congress later added a narrow, separate waiver — § 2712 — letting certain surveillance claims be brought against the United States, but it is hedged, capped, and procedurally demanding. So the one defendant you most need to reach for government over-collection — the government — is the one the blueprint mostly lets off. A private right of action that cannot reach the actual violator is a rule with no remedy all over again, just wearing a different robe.
So § 10 does six things, and the first is to refuse that flinch.
First, a real private right of action against the government. Any person whose digital property was collected, retained, analyzed, used, or disclosed in violation of this Act may sue — and the Act waives sovereign immunity for the responsible government entity, not just for a hand-picked sliver of claims. This is the hard political ask, and I won’t pretend otherwise. Every upstream section I’ve drafted is only as real as the citizen’s ability to make someone answer for breaking it, and the someone is usually the government.
Second, a statutory damages floor. The injury from being over-surveilled is real but impossible to price: what is the dollar value of six years of your private data sitting in a government system you never knew about? If each plaintiff must prove quantified harm, almost none can, and the violation goes uncompensated and therefore undeterred. A statutory floor — Title III fixes one, and § 10 should too — lets Congress set the price of the violation itself, so the wrong is actionable without a forensic accounting of a harm that is dignitary by nature.
Third, fee-shifting. Individually, these harms are small; the over-collected bystander’s case is worth more in principle than it will ever be worth in damages. Without attorney’s fees, no competent lawyer takes it, and the right exists only on paper. Fee-shifting is what moves a real violation from “technically actionable” to “actually litigated.”
Fourth, injunctive relief — and this is the piece suppression structurally cannot give. Damages look backward; an injunction looks forward. It lets a court order the government to purge data it should never have kept, to stop a practice, to delete the non-responsive remainder it was supposed to segregate under § 6. This is the only remedy that reaches the retention and analysis harm directly, by making the government get rid of the thing, rather than merely declining to use it in a trial that may never come.
Fifth, liability that immunity can’t hollow out. Route the action to the government entity rather than resting it on an individual officer’s exposure, and tie the statutory floor to the violation rather than to whether the law was “clearly established.” Qualified immunity has quietly eaten most constitutional-tort deterrence; a statutory damages regime aimed at the institution is how you keep § 10 from being litigated to death on immunity before it ever reaches the merits. (That fight — qualified immunity versus a statutory floor — gets its own post later; for now the design principle is enough.)
Sixth — and this is the one the whole remedy cannot live without — notice. Every mechanism above presumes the citizen knows she was wronged. But the defining feature of digital over-collection is that the person never finds out: the geofenced bystander, the accountholder whose non-responsive data was retained for years, the subject of an investigation that quietly closes with no charge. You cannot institute a civil action to vindicate a violation you have no idea occurred. A private right of action without a notice duty is a key cut for a lock no one is ever shown. Title III understood this and never let its civil remedy stand alone — it paired § 2520 with the § 2518(8)(d) inventory, the duty to notify intercepted persons after the fact. The model act does the same: § 10 is backed by the notice-and-inventory duty slotted into § 4, and the limitations clock on a § 10 action runs from the date of notice, not the date of the violation. Notice is the hinge that turns the right from a theory on paper into something a person can assert.
Now the objections. The first is floodgates: a private right of action with fee-shifting invites a wave of litigation and chills legitimate investigation — agents second-guessing lawful work for fear of being sued. I take that seriously, which is why § 10 is bounded: it attaches to violations of the Act’s specific rules, not to a general grievance about being investigated; the statutory floor is calibrated, not punitive by default; and the alternative is worse. A rule that binds the government only when it happens to prosecute someone is not really a rule. The chilling the government should feel is the chilling against breaking the retention clock and the use restriction — that is the point.
The second objection is sovereign immunity itself: letting citizens sue the United States for damages is a constitutional and fiscal big deal, and courts and Congress guard that waiver jealously. True. But the waiver is not a side effect of § 10 — it is the substance of it. We already accept that the government pays when it takes your property or breaches its contracts. Over-collecting, hoarding, and mining your digital life is a cognizable harm of the same order, and a bounded, floor-limited waiver is how a free country prices it. Narrow it carefully, cap it if you must — but do not write the government out of its own accountability the way Title III did.
Put § 9 and § 10 together and you cover the whole field. Suppression deters in the case the government is trying to win; civil damages and injunctions deter in the vastly larger set of cases where the citizen was wronged and no one was ever charged — and they reach the retention and disclosure harm itself, not just its evidentiary echo. One remedy for the defendant, one for everyone else.
A notice duty, though, only reaches the people the government can identify and is willing to tell. Plenty of over-collection touches people it never names — swept-in third parties, data retained against a case that goes nowhere, communications queried out of a database the subject never knew existed. For them, even an inventory requirement comes up empty, and a suit no one knows to bring deters nothing. So the last structural piece is the check that does not wait for any individual victim to surface: § 11, reporting and oversight. Sunlight, as the only remedy that operates on the cases no one will ever litigate — the subject of next Tuesday.
Leave a Reply