Year In Review: 2024 CCPA Litigation Trends

While the California Consumer Privacy Act (CCPA) is most known for its extensive privacy compliance obligations, the law also provides for a limited private right of action for certain security-related breaches. Section 1798.150(a)(1) of the CCPA provides for a private right of action for consumers if their "nonencrypted and nonredacted personal information" is subject to unauthorized access and exfiltration, theft, or disclosure caused by a business's failure to "implement and maintain security procedures and practices." Cal. Civ. Code. § 1798.150(a)(1). Damages available to consumers under this private right of action provision can be as high as $750 per violation. Courts can also provide consumers with injunctive or declaratory relief and "any other relief the court deems proper." Cal. Civ. Code. § 1798.150(a)(1)(B) and (C).