With the California Consumer Privacy Act (CCPA) – the
strictest privacy law in the nation – now in effect, an
important question for businesses to consider is whether it applies
to conduct that occurred prior to the law's effective
date of Jan. 1. This question is particularly relevant to the
private right of action section of the CCPA, Section 1798.150.
Section 1798.150 provides consumers with a private right of
action based on a "business's violation of the duty to
implement and maintain reasonable security procedures"
resulting in "unauthorized access and exfiltration, theft, or
disclosure" of the consumer's nonencrypted or nonredacted
personal information. Cal. Civil Code § 1798.150. A
"business" is defined as any entity that (1) has annual
gross revenue of over $25 million; (2) buys, sells or shares the
personal information of 50,000 or more consumers per year; or (3)
derives 50 percent or more of its annual revenue from selling
consumers' personal information. I
