DATA PRIVACY – CCPA

The California Consumer Protection Act (“CCPA”) secures new privacy rights for California consumers, which includes:

• The right to know about the personal information a business collects about them and how it is used and shared;
  
• The right to delete personal information collected from them (with some exceptions);
• The right to opt-out of the sale of their personal information; and
• The right to non-discrimination for exercising their CCPA rights.

The CCPA also includes a private right of action for certain victims of data breaches that expose a consumer’s “personal information” as defined by California Civil Code section 1798.81.5. This personal information includes a social security number; driver’s license number, California identification card number, tax identification number, passport number, military identification number, or other unique identification number issued on a government document commonly used to verify the identity of a specific individual; account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account; medical information; health insurance information; unique biometric data generated from measurements or technical analysis of human body characteristics; genetic data; or a username or email address in combination with a password or security question and answer that would permit access to an online account.

Under the law, consumers are entitled to recover between $100 to $750 in statutory damages or any actual damages incurred—whichever is greater. Specifically, California Civil Code section 1798.150(a) provides that “[a]ny consumer whose nonencrypted or nonredacted personal information . . . is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action for any of the following:

• (A) To recover damages in an amount not less than one hundred dollars ($100) and not greater than seven hundred and fifty ($750) per consumer per incident or actual damages, whichever is greater.
• (B) Injunctive or declaratory relief.
• (C) Any other relief the court deems proper.