Year In Review: CCPA Litigation Trends From 2023

This post is part of a series of articles we are doing on 2023 data protection litigation trends. To stay up to date with our writings, please subscribe to the WilmerHale Privacy and Cybersecurity Blog.

While the California Consumer Privacy Act (CCPA) is most known for its onerous privacy compliance obligations, the law also provides for a limited private right of action for certain data breaches. Section 1798.150(a)(1) of the CCPA allows consumers to sue a business if consumers' "nonencrypted and nonredacted personal information" is subject to unauthorized access and exfiltration, theft, or disclosure caused by a business's failure to "implement and maintain security procedures and practices." Cal. Civ. Code. § 1798.150(a)(1). Damages available to consumers under this private right of action provision can be as high as $750 per violation. Courts can also provide consumers injunctive or declaratory relief and "any other relief the court deems proper." Cal. Civ.