Suing Over a Data Breach in California: The CCPA's Private Right of Action

Data breach cases used to be hard to win. Courts often dismissed them on the ground that a person whose information had been stolen, but not yet misused, hadn't suffered a concrete injury. The company apologized, offered a year of credit monitoring, and the matter ended there.

California took a different approach. The California Consumer Privacy Act, as amended by the California Privacy Rights Act, created a private right of action specifically for breaches, and it comes with statutory damages that don't depend on proving you lost money.

The statute

Under Cal. Civ. Code § 1798.150(a), a consumer may sue if their nonencrypted and nonredacted personal information was subject to unauthorized access and exfiltration, theft, or disclosure as a result of the business's violation of its duty to implement and maintain reasonable security procedures and practices. The consumer can recover damages of not less than $100 and not more than $750 per consumer per incident, or actual damages, whichever is greater, along with injunctive or declaratory relief and any other relief the court considers proper.

The statute allows those dollar amounts to be adjusted for inflation, so the current figures may be somewhat higher. It also expressly authorizes these cases to be brought individually or as class actions. Because damages are calculated per consumer, a breach affecting a large number of Californians can create very large exposure even at the statutory minimum.

Which information qualifies

This private right of action doesn't cover every kind of data. It uses the definition of personal information in Cal. Civ. Code § 1798.81.5(d)(1)(A), which is narrower than the CCPA's general definition. It covers your first name or first initial and last name combined with any of the following, where either the name or the data element wasn't encrypted or redacted:

• Social Security number
• driver's license, California ID, tax ID, passport, military ID, or another unique government identification number
• financial account, credit card, or debit card number together with a code or password that would allow access to the account
• medical information or health insurance information
• unique biometric data used to authenticate identity, such as a fingerprint or retina scan
• genetic data

Section 1798.150 also covers an email address combined with a password or security question and answer that would allow access to the account. A breach that exposed only names and email addresses, without more, generally won't support statutory damages under this section, though other claims may still be available.

Reasonable security

The claim requires a breach caused by the business's failure to maintain reasonable security, the same duty Cal. Civ. Code § 1798.81.5(b) imposes on businesses that own or license Californians' personal information. The statute doesn't define what's reasonable, and that's usually the central fight. Evidence that a company left known vulnerabilities unpatched, stored sensitive data unencrypted, didn't use multifactor authentication, kept data long after it needed it, or fell short of common security frameworks all bears on the question. Companies' own breach notices sometimes describe what went wrong in more detail than they'd like.

The 30-day notice

Before suing for statutory damages, a consumer must give the business 30 days' written notice identifying the specific provisions allegedly violated. See § 1798.150(b). If the business actually cures the violation within those 30 days and gives a written statement that it has done so and that no further violations will occur, statutory damages aren't available.

The CPRA amendments limited what counts as a cure. Implementing and maintaining reasonable security after a breach doesn't cure that breach. The notice requirement doesn't apply to a suit seeking only actual damages.

Other claims that often come along

Breach complaints in California commonly pair the CCPA claim with negligence, breach of implied contract, the Unfair Competition Law (Cal. Bus. & Prof. Code § 17200), and the Customer Records Act, whose private right of action is in Cal. Civ. Code § 1798.84. When medical information is involved, the Confidentiality of Medical Information Act, Cal. Civ. Code § 56 and following, may apply as well. These can reach data or businesses the CCPA claim doesn't.

Timing

The CCPA doesn't specify a limitations period for the breach claim, and the period that applies may depend on how a court characterizes it. The period for a negligence claim can be two or three years depending on the harm alleged, and UCL claims carry four. Given that uncertainty, and the 30-day notice step, it's better to get advice soon after receiving a breach letter than to wait.