The California Consumer Privacy Act of 2018 (CCPA) secured privacy rights for California consumers as of January 1, 2020. The courts are starting to adjudicate legal cases, mainly class actions, as the CCPA provides a private right of action to “any consumer who has nonencrypted and nonredacted personal information… or whose email address is subject to a unauthorized access and infiltration, theft or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information.”

 

The CCPA secures privacy rights for California consumers, including:

 

•The right to know personal information a business collects about the consumer and how it is shared and used;

•The right to delete personal information that a business collects about the consumer;

•The right to opt-out of the sale of one’s personal information; and

•The right to non-discrimination in exercising one’s CCPA rights.

 

To enforce these rights, businesses can expect lawsuits, especially class-action suits, for infringement of these rights. Particularly, there are statutory (automatic) damages “in amounts not less than One Hundred Dollars ($100) and not greater than Seven Hundred Fifty Dollars ($750) per consumer per incident or actual damages, whichever is greater”.

 

Best practices-

 

•Have a privacy policy in place on your website or other communication with consumers; and

•If a data breach occurs, take immediate action as required by statute to notify consumers and to stop the activities underlining the breach through which data is being collected.

 

“Standing” to bring a case for data breaches under the CCPA is the current line of defense. In order to succeed in litigation; there is a need for damages and the Ninth Circuit Court of Appeals (the Federal court for our area) has issued decisions to indicate when a plaintiff has “standing” to proceed with a lawsuit under the CCPA. These cases are Krottner v. Starbucks, 628 Fed 3rd 1139 and more recently, Ree v. Zappos.com, Inc., 888 Fed 3rd 120. For data-breach standing, Zappos.com held that that occurs when (1) there is theft by outside hackers, (2) of highly sensitive personal information, (3) leading to the misuse of at least some named plaintiff’s personal information.

 

In evaluating this criteria, the recent case of Arifur Rahman v. Marriott, the California Central District Federal Court in Los Angeles, recently determined that the complainants “had not plausibly pled here that any of their more sensitive data… such as credit card information, passports, social security numbers… has fallen into the wrong hands. Without a breach of this type of sensitive information, plaintiff has not suffered an injury in fact and cannot meet the constitutional requirement of standing.”

 

Businesses should not rely on the court system, however. Please have a privacy policy for your business and systems that preclude a data-breach and/or adequately deal with it, but winning in court on these consumer cases cannot be assured.