Under the California Consumer Protection Act (CCPA), consumers are granted several rights. One of these is the private right of action, which allows consumers to sue businesses. However, some conditions need to be met in order to proceed with legal action.
The Private Right of Action under the CCPA allows individual consumers to sue businesses that violate the law. In particular, this right is defined in Cal. Civ. Code § 1798.150, which states that consumers can sue a business if their nonencrypted and nonredacted personal information was stolen in a data breach, as a result of the business’s failure to keep adequate security procedures and practices to protect it.
The California Consumer Protection Act defines a business as a for-profit organization that collects the personal information of consumers, determines the purposes and method of the processing, targets Californian residents, and meets at least one of the following requirements:
As we said, consumers can’t sue businesses for any violation of the Act, but only when certain conditions are met.
Moreover, the business must also process specific categories of personal information to be sued. The Act specifies that to exercise the private right of action, the following information should be stolen in the data breach:
In 2023, the CCPA was amended by the California Privacy Rights Act (CPRA) to expand consumers’ rights. The CPRA also expanded the private right of action to include email addresses in combination with a password or security questions and answers in the list of personal information categories that are covered under the Act.
Before suing, consumers must inform the business with a written notice, explaining which section of the Act was violated. Businesses have 30 days to respond and fix the issue.
If the business is able to fix the issue and gives its written statement that it has done so, consumers cannot sue the business. If, instead, the violation continues, consumers can proceed with the legal action.
For any other violation of the CCPA, consumers can file a complaint with the Attorney General or the California Privacy Protection Agency, which will take care of investigating and proceeding with legal actions.
A consumer may sue for either type of damages:
Though it may seem like a small amount, if compared with other privacy laws, you must note that the Act says “per violation”. A violation happens every time a consumer’s data is breached, and typically, a data breach involves a large number of consumers.
As a business, of course, you want to avoid getting sued. That’s why you shouldn’t overlook compliance with the CCPA.
Among other things, the CCPA requires you to take security measures to protect the personal information you collect and process. Even though the CCPA does not explicitly say what security measures you should apply, it talks about “reasonable security practices”.
Here are a few things you can do to safeguard your data:
Read also:
Attorney-level solutions to make your websites and apps compliant with the law across multiple countries and legislations.