Five Steps To Mitigate CCPA Class Action Risk: What Companies Need To Do To Increase Data Security

While many companies and service providers are spending significant time and budget on the privacy-related requirements of the forthcoming California Consumer Privacy Act (CCPA), the largest exposure for companies not selling or bartering personal information may be a class action for failing to define and maintain reasonable security. Starting January 1, 2020, consumers will be able to sue businesses under California's strict new privacy law for data breaches caused by the failure to maintain "reasonable security." For that reason, businesses should begin reviewing their existing security procedures and practices and implementing any additional measures that will establish a defensible security program according to the state of California.