Which privacy laws apply to your business in the District of Columbia?
The District of Columbia has no comprehensive consumer-privacy statute — no general rights of access, deletion, correction, or opt-out, and no controller-processor framework. Two District laws do the work instead. The Consumer Protection Procedures Act (CPPA) makes it a violation for any person to engage in an unfair or deceptive trade practice, whether or not any consumer is in fact misled, deceived, or damaged . The breach-notice duty applies to a person or entity conducting business in the District that owns or licenses covered electronic data and discovers a breach . Separate security, vendor-contract, and destruction duties apply under their own conduct triggers in § 28-3852.01 , while the definition of person or entity broadly covers private individuals and organizations but excludes the District government itself .
Because there is no omnibus act, District residents have no statutory rights to access, delete, or correct their data, no right to opt out of sale or targeted advertising, and no recognized universal opt-out signal under District law. What fills the gap is the CPPA plus the federal overlay. The CPPA is liberally construed: it must be construed and applied liberally, and it establishes an enforceable right to truthful information from merchants about consumer goods and services purchased, leased, or received in the District . Misleading privacy settings, undisclosed data sharing, and broken security promises all plead as unfair or deceptive trade practices — which matters here because the CPPA carries a broad private right of action, covered in the consumer-lawsuit section below. The federal layer then applies as it does everywhere: FTC Act § 5 reaches deceptive or unfair privacy practices generally, the Gramm-Leach-Bliley Act governs financial institutions, HIPAA governs covered health entities, and COPPA governs services directed to children under 13. This note is written to stay durable: if the Council later enacts an omnibus law, a program built to the CPPA-plus-overlay framework upgrades rather than restarts.
Sources for this answer
Primary law
A.1 D.C. Code § 28-3904The CPPA makes it a violation for any person to engage in an unfair or deceptive trade practice, whether or not any consumer is in fact misled, deceived, or damaged.
It shall be a violation of this chapter for any person to engage in an unfair or deceptive trade practice, whether or not any consumer is in fact misled, deceived, or damaged thereby
See D.C. Code § 28-3904.
Primary law
A.2 D.C. Code § 28-3852(a)The resident breach-notice duty applies to a person or entity conducting business in the District that owns or licenses covered electronic data and discovers a breach.
Any person or entity who conducts business in the District of Columbia, and who, in the course of such business, owns or licenses computerized or other electronic data that includes personal information, and who discovers a breach of the security of the system, shall promptly notify any District of Columbia resident whose personal information was included in the breach.
See D.C. Code § 28-3852(a).
Primary law
A.6 D.C. Code § 28-3851The breach subchapter defines person or entity to include individuals, firms, corporations, and other private organizations, while excluding the District government and its agencies or instrumentalities.
"Person or entity" means an individual, firm, corporation, partnership, company, cooperative, association, trust, or any other organization, legal entity, or group of individuals. The term "person or entity" shall not include the District of Columbia government or any of its agencies or instrumentalities.
See D.C. Code § 28-3851(2A).
Primary law
A.3 D.C. Code § 28-3852.01(a)The security-safeguards duty applies to a person or entity that owns, licenses, maintains, handles, or otherwise possesses personal information of a District resident.
To protect personal information from unauthorized access, use, modification, disclosure, or a reasonably anticipated hazard or threat, a person or entity that owns, licenses, maintains, handles, or otherwise possesses personal information of an individual residing in the District shall implement and maintain reasonable security safeguards, including procedures and practices that are appropriate to the nature of the personal information and the nature and size of the entity or operation.
See D.C. Code § 28-3852.01(a).
Primary law
A.4 D.C. Code § 28-3852.01(b)The vendor-contract duty applies when a person or entity discloses a District resident's personal information to a nonaffiliated third-party service provider under a written agreement.
A person or entity that uses a nonaffiliated third party as a service provider to perform services for a person or entity and discloses personal information about an individual residing in the District under a written agreement with the third party shall require by the agreement that the third party implement and maintain reasonable security procedures and practices
See D.C. Code § 28-3852.01(b).
Primary law
A.5 D.C. Code § 28-3852.01(c)The destruction duty applies when a person or entity destroys records containing personal information of a consumer, employee, or former employee.
When a person or entity is destroying records, including computerized or electronic records and devices containing computerized or electronic records, that contain personal information of a consumer, employee, or former employee of the person or entity, the person or entity shall take reasonable steps to protect against unauthorized access to or use of the personal information
See D.C. Code § 28-3852.01(c).
Primary law
A.7 D.C. Code § 28-3901The CPPA is construed and applied liberally and establishes an enforceable right to truthful information from merchants about consumer goods and services.
This chapter shall be construed and applied liberally to promote its purpose. This chapter establishes an enforceable right to truthful information from merchants about consumer goods and services that are or would be purchased, leased, or received in the District of Columbia.
See D.C. Code § 28-3901(c).
What must your privacy policy say in the District of Columbia?
No District statute requires a general consumer privacy policy or fixes what it must contain. The binding rule is that whatever you publish must be true: the CPPA makes it a violation to misrepresent as to a material fact which has a tendency to mislead, or to fail to state a material fact if the failure tends to mislead , and FTC Act § 5 separately declares unfair or deceptive acts or practices in commerce unlawful . A privacy policy that misstates how you collect, use, share, or secure data is actionable under both.
The CPPA expressly directs courts to give FTC Act § 5 interpretations due consideration and weight: in construing an unfair or deceptive trade practice, courts must give due consideration and weight to how the Federal Trade Commission and the federal courts interpret FTC Act § 5 . Federal deception doctrine on privacy promises, omissions, and broken security commitments is therefore an important interpretive guide under District law. Where a sectoral regime applies, it supplies the contents: a HIPAA covered entity must give individuals a notice of the uses and disclosures of their protected health information and of their rights and the entity's duties , a GLBA financial institution must provide a notice that complies with 15 U.S.C. § 6803 before disclosing nonpublic personal information to a nonaffiliated third party , and COPPA requires covered child-directed operators to provide website notice of child-data collection, use, and disclosure practices . For everyone else, build the policy as best practice — categories of data collected, purposes, third-party sharing, and how users exercise any choices you offer — and then honor it. The stakes of a mismatch are higher in the District than in most sectoral jurisdictions: a misstatement needs no proof that any consumer was actually misled, and it is enforceable not just by the Attorney General but by the CPPA's unusually broad private-plaintiff classes, covered below.
Sources for this answer
Primary law
B.1 D.C. Code § 28-3904(e)–(f)It is an unfair or deceptive trade practice to misrepresent a material fact with a tendency to mislead or to fail to state a material fact where the omission tends to mislead — the CPPA hooks for inaccurate privacy policies.
(e) misrepresent as to a material fact which has a tendency to mislead; (e-1) represent that a transaction confers or involves rights, remedies, or obligations which it does not have or involve, or which are prohibited by law; (f) fail to state a material fact if such failure tends to mislead;
See D.C. Code § 28-3904(e)–(f).
Primary law
B.3 D.C. Code § 28-3901(d)The CPPA directs courts to give FTC and federal-court interpretations of FTC Act § 5 due consideration and weight when construing an unfair or deceptive trade practice.
In construing the term "unfair or deceptive trade practice" due consideration and weight shall be given to the interpretation by the Federal Trade Commission and the federal courts of the term "unfair or deceptive act or practice," as employed in section 5(a) of An Act To create a Federal Trade Commission
See D.C. Code § 28-3901(d).
Primary law
B.2 FTC Act § 5Section 5 of the FTC Act declares unfair or deceptive acts or practices in or affecting commerce unlawful, which reaches a privacy policy that misstates a business's actual data practices.
Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful.
See 15 U.S.C. § 45(a)(1).
Primary law
B.4 HIPAA Notice of Privacy PracticesA HIPAA covered entity must give individuals a notice describing the uses and disclosures of their protected health information and their rights and the entity's legal duties.
an individual has a right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to protected health information
See 45 C.F.R. § 164.520.
Primary law
B.5 GLBA Privacy NoticeGLBA requires a financial institution to provide a notice that complies with 15 U.S.C. § 6803 before disclosing nonpublic personal information to a nonaffiliated third party.
a financial institution may not, directly or through any affiliate, disclose to a nonaffiliated third party any nonpublic personal information, unless such financial institution provides or has provided to the consumer a notice that complies with section 6803 of this title
See 15 U.S.C. § 6802(a).
Primary law
B.6 COPPA Online NoticeCOPPA requires covered child-directed operators to provide website notice of what information is collected from children and how it is used and disclosed.
to provide notice on the website of what information is collected from children by the operator, how the operator uses such information, and the operator’s disclosure practices for such information
See 15 U.S.C. § 6502(b)(1)(A)(i).
What must your contracts with vendors say about D.C. residents' data?
The District has no omnibus data-processing-agreement statute — no prescribed processing instructions, audit rights, or subprocessor flow-downs. But unlike most sectoral jurisdictions, it does impose one targeted contract duty: a person or entity that discloses a District resident's personal information to a nonaffiliated third-party service provider under a written agreement must require, by that agreement, that the provider implement and maintain reasonable security procedures and practices appropriate to the information and reasonably designed to protect it from unauthorized access, use, modification, and disclosure .
That clause — added by the 2020 breach-law overhaul — makes a security term in every D.C.-facing vendor agreement a statutory requirement, not just hygiene. It is narrower than a comprehensive-state data processing agreement: it addresses security only, not processing purposes, deletion, or assistance duties. Where a federal regime applies, it adds its own contracting layer: the GLBA Safeguards Rule requires financial institutions to oversee service providers and to require them by contract to implement and maintain appropriate safeguards , and HIPAA requires a business-associate agreement with mandatory data-protection, breach-reporting, and subcontractor terms before sharing protected health information . The practical drafting move for a vendor template touching D.C. residents is to fold the statutory security clause into the broader best-practice set — processing limited to documented instructions, confidentiality, breach notification back to your business, and return or deletion of data at the end of the engagement — so one rider satisfies the District requirement and the federal overlays at once.
Sources for this answer
Primary law
C.1 D.C. Code § 28-3852.01(b)When personal information of a District resident is disclosed to a nonaffiliated third-party service provider under a written agreement, the agreement must require the provider to implement and maintain reasonable security procedures and practices.
A person or entity that uses a nonaffiliated third party as a service provider to perform services for a person or entity and discloses personal information about an individual residing in the District under a written agreement with the third party shall require by the agreement that the third party implement and maintain reasonable security procedures and practices that: (1) Are appropriate to the nature of the personal information disclosed to the nonaffiliated third party; and (2) Are reasonably designed to protect the personal information from unauthorized access, use, modification, and disclosure.
See D.C. Code § 28-3852.01(b).
Primary law
C.2 GLBA Safeguards RuleThe GLBA Safeguards Rule requires a financial institution to oversee its service providers, including by requiring them by contract to implement and maintain appropriate safeguards for customer information.
Requiring your service providers by contract to implement and maintain such safeguards
See 16 C.F.R. § 314.4(f)(2).
Primary law
C.3 HIPAA Business Associate ContractsHIPAA requires a business-associate contract to establish permitted uses and disclosures and require safeguards, breach reporting, and subcontractor flow-down terms.
A contract between the covered entity and a business associate must: (i) Establish the permitted and required uses and disclosures of protected health information by the business associate. The contract may not authorize the business associate to use or further disclose the information in a manner that would violate the requirements of this subpart, if done by the covered entity, except that: (A) The contract may permit the business associate to use and disclose protected health information for the proper management and administration of the business associate, as provided in paragraph (e)(4) of this section; and (B) The contract may permit the business associate to provide data aggregation services relating to the health care operations of the covered entity. (ii) Provide that the business associate will: (A) Not use or further disclose the information other than as permitted or required by the contract or as required by law; (B) Use appropriate safeguards and comply, where applicable, with subpart C of this part with respect to electronic protected health information, to prevent use or disclosure of the information other than as provided for by its contract; (C) Report to the covered entity any use or disclosure of the information not provided for by its contract of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410; (D) In accordance with § 164.502(e)(1)(ii), ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the business associate agree to the same restrictions and conditions that apply to the business associate with respect to such information;
See 45 C.F.R. § 164.504(e).
Does District of Columbia law require you to protect personal data?
Yes. Since the 2020 breach-law overhaul, any person or entity that owns, licenses, maintains, handles, or otherwise possesses the personal information of a District resident must implement and maintain reasonable security safeguards, including procedures and practices appropriate to the nature of the personal information and to the nature and size of the entity or operation . This is an affirmative data-security duty that applies before any breach occurs; the quoted duty does not include a separate size threshold, although the reasonableness standard scales to the nature and size of the entity or operation.
The duty extends through the data lifecycle: when destroying records that contain the personal information of a consumer, employee, or former employee — including electronic records and the devices that hold them — the person or entity must take reasonable steps to protect against unauthorized access to or use of that information . The statute scales the standard to the data and the organization rather than defining reasonable security safeguards with a control list, so what is reasonable for a small retailer differs from what is reasonable for a data-rich platform. Entities already regulated federally get a deemed-compliance provision: a person or entity subject to and in compliance with the security requirements of the Gramm-Leach-Bliley Act, HIPAA, or the HITECH Act is deemed to comply with this section . The teeth come from the enforcement bridge covered below — a violation of the security duty, like a violation of the notice duties, is an unfair or deceptive trade practice under the CPPA.
Sources for this answer
Primary law
D.1 D.C. Code § 28-3852.01(a)Anyone who owns, licenses, maintains, handles, or possesses a District resident's personal information must implement and maintain reasonable security safeguards appropriate to the data and to the entity's nature and size.
To protect personal information from unauthorized access, use, modification, disclosure, or a reasonably anticipated hazard or threat, a person or entity that owns, licenses, maintains, handles, or otherwise possesses personal information of an individual residing in the District shall implement and maintain reasonable security safeguards, including procedures and practices that are appropriate to the nature of the personal information and the nature and size of the entity or operation.
See D.C. Code § 28-3852.01(a).
Primary law
D.2 D.C. Code § 28-3852.01(c)When destroying records containing personal information of a consumer, employee, or former employee, the person or entity must take reasonable steps to protect against unauthorized access to or use of the information.
When a person or entity is destroying records, including computerized or electronic records and devices containing computerized or electronic records, that contain personal information of a consumer, employee, or former employee of the person or entity, the person or entity shall take reasonable steps to protect against unauthorized access to or use of the personal information
See D.C. Code § 28-3852.01(c).
Primary law
D.3 D.C. Code § 28-3852.01(d)An entity subject to and in compliance with the security requirements of GLBA, HIPAA, or the HITECH Act is deemed to be in compliance with the District's security-safeguards section.
A person or entity who is subject to and in compliance with requirements for security procedures and practices contained in Title V of the Gramm-Leach-Bliley Act, approved November 12, 1999 (113 Stat. 1436; 15 U.S.C. § 6801 et seq .), or the Health Insurance Portability Accountability Act of 1996, approved August 21, 1996 (Pub. L. No. 104-191; 110 Stat. 1936), or the Health Information Technology for Economic and Clinical Health Act, approved February 17, 2009 (Pub. L. No.111-5; 123 Stat. 226), and any rules, regulations, guidance and guidelines thereto, shall be deemed to be in compliance with this section
See D.C. Code § 28-3852.01(d).
When must you notify people of a data breach in the District of Columbia?
Promptly. Any person or entity that conducts business in the District and owns or licenses electronic data including personal information must notify every District resident whose personal information was included in a breach, in the most expedient time possible and without unreasonable delay . If the breach affects 50 or more District residents, written notice must also go promptly to the Office of the Attorney General — no later than when residents are notified . And when a breach requires notification under § 28-3852(a) or (b) and includes or is reasonably believed to include Social Security or taxpayer identification numbers, the entity must offer identity-theft protection services at no cost for at least 18 months to each District resident whose Social Security number or taxpayer identification number was released .
The trigger is broad. A breach of the security of the system means the unauthorized acquisition of computerized or other electronic data — or any equipment or device storing such data — that compromises the security, confidentiality, or integrity of personal information . Personal information covers far more than Social Security numbers: a name or other identifier combined with a government ID number, a financial-account or card number with its access code, medical information, genetic information, health-insurance information, or biometric data — and, standing alone, a username or e-mail address combined with a password or other means of authentication that permits access to the person's e-mail account . Two exclusions matter operationally. Properly encrypted or redacted data is outside the definition unless the protection itself was compromised. And the risk-of-harm exit is not unilateral: an acquisition falls outside the definition only if the entity reasonably determines, after a reasonable investigation and consultation with the Office of the Attorney General and federal law enforcement, that harm to the individual is unlikely . The Attorney General notice must include eleven enumerated items, from the cause of the breach to a sample of the resident notice . Entities that give notice under the GLBA or HIPAA/HITECH breach-notification regimes can satisfy the resident-notice duty that way, but that does not eliminate any Attorney General notice required by § 28-3852(b-1) .
Sources for this answer
Primary law
E.1 D.C. Code § 28-3852(a)A business that owns or licenses electronic data including personal information must promptly notify any District resident whose personal information was included in a breach, in the most expedient time possible and without unreasonable delay.
Any person or entity who conducts business in the District of Columbia, and who, in the course of such business, owns or licenses computerized or other electronic data that includes personal information, and who discovers a breach of the security of the system, shall promptly notify any District of Columbia resident whose personal information was included in the breach. The notification shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subsection (d) of this section, and with any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
See D.C. Code § 28-3852(a).
Primary law
E.2 D.C. Code § 28-3852(b-1)If a breach affects 50 or more District residents, the entity must promptly give written notice to the Office of the Attorney General, no later than when residents are notified.
In addition to giving the notification required under subsection (a) of this section, and subject to subsection (d) of this section, the person or entity required to give notice shall promptly provide written notice of the breach of the security of the system to the Office of the Attorney General for the District of Columbia if the breach affects 50 or more District residents. This notice shall be made in the most expedient manner possible, without unreasonable delay, and in no event later than when notice is provided under subsection (a) of this section.
See D.C. Code § 28-3852(b-1).
Primary law
E.3 D.C. Code § 28-3852.02When a breach requires notification under § 28-3852(a) or (b) and includes or is reasonably believed to include a Social Security or taxpayer identification number, the entity must offer at least 18 months of no-cost identity-theft protection to each District resident whose Social Security number or taxpayer identification number was released.
When a person or entity experiences a breach of the security of the system that requires notification under § 28-3852(a) or (b) , and such breach includes or is reasonably believed to include a social security number or taxpayer identification number, the person or entity shall offer to each District resident whose social security number or tax identification number was released identity theft protection services at no cost to such District resident for a period of not less than 18 months. The person or entity that experienced the breach of the security of its system shall provide all information necessary for District residents to enroll in the services required under this section.
See D.C. Code § 28-3852.02.
Primary law
E.4 D.C. Code § 28-3851(1)(A)A breach of the security of the system is the unauthorized acquisition of computerized or other electronic data, or equipment storing such data, that compromises the security, confidentiality, or integrity of personal information.
"Breach of the security of the system" means unauthorized acquisition of computerized or other electronic data or any equipment or device storing such data that compromises the security, confidentiality, or integrity of personal information maintained by the person or entity who conducts business in the District of Columbia.
See D.C. Code § 28-3851(1)(A).
Primary law
E.5 D.C. Code § 28-3851(3)(A)Personal information includes a name or other personal identifier combined with government ID numbers, financial-account access data, medical information, genetic information, health-insurance information, or biometric data.
An individual's first name, first initial and last name, or any other personal identifier, which, in combination with any of the following data elements, can be used to identify a person or the person's information: (I) Social security number, Individual Taxpayer Identification Number, passport number, driver's license number, District of Columbia identification card number, military identification number, or other unique identification number issued on a government document commonly used to verify the identity of a specific individual; (II) Account number, credit card number or debit card number, or any other number or code or combination of numbers or codes, such as an identification number, security code, access code, or password, that allows access to or use of an individual's financial or credit account; (III) Medical information; (IV) Genetic information and deoxyribonucleic acid profile; (V) Health insurance information, including a policy number, subscriber information number, or any unique identifier used by a health insurer to identify the person that permits access to an individual's health and billing information; (VI) Biometric data of an individual generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, voice print, genetic print, retina or iris image, or other unique biological characteristic, that is used to uniquely authenticate the individual's identity when the individual accesses a system or account;
See D.C. Code § 28-3851(3)(A)(i)(I)–(VI).
Primary law
E.6 D.C. Code § 28-3851(3)(A)(ii)Online-account credentials count as personal information on their own — a username or e-mail address combined with a password, security question and answer, or other authentication that permits access to the e-mail account.
A user name or e-mail address in combination with a password, security question and answer, or other means of authentication, or any combination of data elements included in sub-sub-subparagraphs (I) through (VI) of sub-subparagraph (i) that permits access to an individual's e-mail account.
See D.C. Code § 28-3851(3)(A)(ii).
Primary law
E.7 D.C. Code § 28-3851(1)(B)(iii)The risk-of-harm exclusion applies only where the entity reasonably determines harm is unlikely after a reasonable investigation and consultation with the D.C. Attorney General and federal law enforcement — it cannot be invoked unilaterally.
Acquisition of personal information of an individual that the person or entity reasonably determines, after a reasonable investigation and consultation with the Office of the Attorney General for the District of Columbia and federal law enforcement agencies, will likely not result in harm to the individual.
See D.C. Code § 28-3851(1)(B)(iii).
Primary law
E.8 D.C. Code § 28-3852(g)GLBA or HIPAA/HITECH breach notice can satisfy resident notice, but it does not eliminate any Attorney General notice required by § 28-3852(b-1).
The person or entity shall, in all cases, provide written notice of the breach of the security of the system to the Office of the Attorney General for the District of Columbia as required under subsection (b-1) of this section.
See D.C. Code § 28-3852(g).
Can a consumer sue your business in the District of Columbia over privacy?
Yes — and not only consumers. The CPPA grants a private right of action to a consumer; to an individual tester when the trade practice involves consumer goods or services purchased or received to test qualities for personal, household, or family purposes; to a nonprofit organization on behalf of itself, members, or the general public; and to a public interest organization on behalf of a consumer or class that could sue as consumers, subject to the sufficient-nexus dismissal rule . A prevailing plaintiff may recover treble damages or $1,500 per violation, whichever is greater, plus punitive damages, attorney's fees, and an injunction . Data-breach and data-security failures are privately actionable too: a violation of the breach subchapter is an unfair or deceptive trade practice , enumerated in the CPPA's list of violations . For § 28-3904(kk), the damages remedy is actual damages rather than treble or $1,500-per-violation statutory damages, and actual damages exclude dignitary damages; fees and injunctive relief remain separately listed .
The standing grants do real work, but they carry conditions. Testers must fit the consumer-goods-or-services testing language, nonprofits must stay within the nonprofit route, and public-interest organizations can sue only where the represented consumer or class could sue as consumers and the organization has a sufficient nexus to the interests represented . Public-interest and general-public claims also face a stay rule: an overlapping Attorney General action under § 28-3909 stays those private claims until the Attorney General action is resolved, and public-interest or general-public plaintiffs must notify OAG within 10 days after filing . CPPA claims belong in D.C. Superior Court , where the statutory grants, rather than the federal injury-in-fact doctrine, frame who can sue. The two-track damages design is a deliberate split: privacy deception claims (a privacy policy or setting that misrepresents practices, under § 28-3904(e) or (f)) carry the full treble-or-$1,500-per-violation remedy, while breach claims routed through § 28-3904(kk) have an actual-damages remedy. Even on the breach track, fee-shifting and injunctive relief remain available , so the carve-out narrows the damages exposure without closing the courthouse door.
Sources for this answer
Primary law
F.1 D.C. Code § 28-3905(k)(1)The CPPA grants private-action paths to consumers, qualifying individual testers, nonprofit organizations, and public interest organizations, with tester, nonprofit, consumer-could-sue, and sufficient-nexus conditions.
A consumer may bring an action seeking relief from the use of a trade practice in violation of a law of the District. (B) An individual may, on behalf of that individual, or on behalf of both the individual and the general public, bring an action seeking relief from the use of a trade practice in violation of a law of the District when that trade practice involves consumer goods or services that the individual purchased or received in order to test or evaluate qualities pertaining to use for personal, household, or family purposes. (C) A nonprofit organization may, on behalf of itself or any of its members, or on any such behalf and on behalf of the general public, bring an action seeking relief from the use of a trade practice in violation of a law of the District, including a violation involving consumer goods or services that the organization purchased or received in order to test or evaluate qualities pertaining to use for personal, household, or family purposes. (D) (i) Subject to sub-subparagraph (ii) of this subparagraph, a public interest organization may, on behalf of the interests of a consumer or a class of consumers, bring an action seeking relief from the use by any person of a trade practice in violation of a law of the District if the consumer or class could bring an action under subparagraph (A) of this paragraph for relief from such use by such person of such trade practice. (ii) An action brought under sub-subparagraph (i) of this subparagraph shall be dismissed if the court determines that the public interest organization does not have sufficient nexus to the interests involved of the consumer or class to adequately represent those interests.
See D.C. Code § 28-3905(k)(1)(A)–(D).
Primary law
F.2 D.C. Code § 28-3905(k)(2)CPPA plaintiffs sue in D.C. Superior Court and may recover treble damages or $1,500 per violation, attorney's fees, punitive damages, and an injunction; for § 28-3904(kk), the damages remedy is actual damages, excluding dignitary damages.
Any claim under this chapter shall be brought in the Superior Court of the District of Columbia and may recover or obtain the following remedies: (A) (i) Treble damages, or $1,500 per violation, whichever is greater, payable to the consumer; (ii) Notwithstanding sub-subparagraph (i) of this subparagraph, for a violation of § 28-3904(kk) a consumer may recover or obtain actual damages. Actual damages shall not include dignitary damages, including pain and suffering. (B) Reasonable attorney’s fees; (C) Punitive damages; (D) An injunction against the use of the unlawful trade practice;
See D.C. Code § 28-3905(k)(2).
Primary law
F.5 D.C. Code § 28-3905(k)(7)An Attorney General action under § 28-3909 stays overlapping public-interest-organization or general-public private claims, and those plaintiffs must notify OAG within 10 days after filing.
Commencement of an action by the Attorney General under § 28-3909 , including the maintenance of an action previously commenced and pending as of [October 1, 2021], shall serve to stay until the resolution of the Attorney General's action any civil action that includes any claim that is: (i) Made pursuant to this subsection by a public interest organization or on behalf of the general public; and (ii) Based in whole or in part on any matter complained of in the action commenced by the Attorney General. (B) A plaintiff that is a public interest organization or is acting on behalf of the general public shall provide notice to the Office of the Attorney General within 10 days of the filing of an action that includes a claim made under this subsection.
See D.C. Code § 28-3905(k)(7).
Primary law
F.3 D.C. Code § 28-3853(b)A violation of the security-breach subchapter — including the notification and security-safeguards duties — is an unfair or deceptive trade practice under the CPPA.
A violation of this subchapter , or any rule issued pursuant to the authority of this subchapter , is an unfair or deceptive trade practice pursuant to § 28-3904(kk)
See D.C. Code § 28-3853(b).
Primary law
F.4 D.C. Code § 28-3904(kk)The CPPA's enumerated violations expressly include violating any provision of the security-breach subchapter — the receiving end of the § 28-3853(b) bridge.
violate any provision of subchapter 2 of Chapter 38 of this title
See D.C. Code § 28-3904(kk).
Who enforces privacy law in the District of Columbia?
There is no privacy-specific regulator; public enforcement runs through the CPPA and the breach subchapter. A consumer can begin an administrative case by filing a complaint with the Department of Licensing and Consumer Protection describing the trade practice , and in that administrative path the Attorney General for the District of Columbia represents the Department in court proceedings under the Act . For data breaches and security failures, the breach subchapter's rights and remedies are cumulative with every other remedy available under law . Cumulative remedies do not erase the CPPA stay and notice rules: an overlapping Attorney General action under § 28-3909 stays public-interest-organization or general-public private claims until the Attorney General action is resolved, and those plaintiffs must notify OAG within 10 days after filing .
Sources for this answer
Primary law
G.1 D.C. Code § 28-3905(a)A CPPA administrative case begins with a complaint filed with the Department of Licensing and Consumer Protection plainly describing the trade practice.
A case is begun by filing with the Department a complaint plainly describing a trade practice and stating the complainant’s (and, if different, the consumer’s) name and address, the name and address (if known) of the respondent, and such other information as the Director may require.
See D.C. Code § 28-3905(a).
Primary law
G.2 D.C. Code § 28-3905(i)(4)The Attorney General for the District of Columbia represents the Department in CPPA enforcement proceedings.
The Attorney General for the District of Columbia shall represent the Department in all proceedings described in this subsection.
See D.C. Code § 28-3905(i)(4).
Primary law
G.3 D.C. Code § 28-3853(c)The breach subchapter's rights and remedies are cumulative with each other and with any other rights and remedies available under law, so public and private enforcement can proceed in parallel.
The rights and remedies available under this section are cumulative to each other and to any other rights and remedies available under law.
See D.C. Code § 28-3853(c).
Primary law
G.4 D.C. Code § 28-3905(k)(7)An Attorney General action under § 28-3909 stays overlapping public-interest-organization or general-public private claims, and those plaintiffs must notify OAG within 10 days after filing.
Commencement of an action by the Attorney General under § 28-3909 , including the maintenance of an action previously commenced and pending as of [October 1, 2021], shall serve to stay until the resolution of the Attorney General's action any civil action that includes any claim that is: (i) Made pursuant to this subsection by a public interest organization or on behalf of the general public; and (ii) Based in whole or in part on any matter complained of in the action commenced by the Attorney General. (B) A plaintiff that is a public interest organization or is acting on behalf of the general public shall provide notice to the Office of the Attorney General within 10 days of the filing of an action that includes a claim made under this subsection.
See D.C. Code § 28-3905(k)(7).