Personal Information Security Breaches: The Private Right of Action

What it requires

The only provision of the CCPA a consumer may sue over, and it is far narrower than the rest of the title. It reaches a consumer whose nonencrypted and nonredacted personal information, as defined in Civ. Code § 1798.81.5(d)(1)(A), or whose email address together with a credential that would permit account access, is subject to unauthorized access and exfiltration, theft, or disclosure because the business failed to implement and maintain reasonable security procedures. Nothing else in the CCPA (a missing opt-out link, an unhonored GPC signal, an undisclosed tracker) gives a consumer a cause of action; those are for the CPPA under § 1798.155 and the Attorney General under § 1798.199.90. Subdivision (c) confines the private action to those breaches and bars using a CCPA violation as the basis for a private suit under any other law, but it leaves alone the causes of action other statutes create on their own: tracking technologies can still draw private suits under the California Invasion of Privacy Act, whose Penal Code § 637.2 gives a person injured by a violation of that chapter a private action. Statutory damages run from one hundred dollars ($100) to seven hundred and fifty ($750) per consumer per incident in the printed text, adjusted under § 1798.199.95(d) to $107 and $799 effective January 1, 2025, with the next adjustment due January 1, 2027. A consumer may recover actual damages instead where they are greater.

Statute text

(a)(1)(A) To recover damages in an amount not less than one hundred dollars ($100) and not greater than seven hundred and fifty ($750) per consumer per incident or actual damages, whichever is greater. The amounts in this subdivision shall be adjusted pursuant to subdivision (d) of Section 1798.199.95.

California Consumer Privacy Act / California Privacy Rights Act, § 1798.150Read the full section from California Privacy Protection Agency (CalPrivacy)