Privacy & Data Security

California Consumer Privacy Act

CCPA Class Action Defense

Fox's Experienced Data Privacy Litigators Defend CCPA Data Breach Lawsuits

The California Consumer Privacy Act (CCPA) grants data breach victims the right to file individual or class action lawsuits against businesses that allow unauthorized access to their non-encrypted or unredacted personal information because of a failure to implement appropriate security practices.

While the California Attorney General has delayed enforcing the act until this summer, this private right of action kicked in when the law took effect on January 1, 2020.

Under CCPA, companies that handle individuals' personal data face statutory damages of between $100 to $750 per consumer, per incident or actual damages, whichever are greater. By establishing statutory damages, CCPA is expected to invite individual and class action lawsuits around both major and minor data breaches by eliminating the need for plaintiffs to prove actual damages. A breach involving the personal data of 10,000 consumers could result in a sizable statutory damages claim of between $1 million and $7.5 million.

In assessing the amount of statutory damages, the court shall consider any one or more of the relevant circumstances presented by any of the parties to the case, including, but not limited to, the nature and seriousness of the misconduct, the number of violations, the persistence of the misconduct, the length of time over which the misconduct occurred, the willfulness of the defendant’s misconduct, and the defendant’s assets, liabilities, and net worth.

— TITLE 1.81.5. California Consumer Privacy Act of 2018 [1798.150]

However, the law allows businesses to avoid statutory damages by quickly curing the violation that led to the breach. Plaintiffs must provide companies with 30 days notice of the filing of a statutory damages claim. During that period, a business can avoid statutory damages by demonstrating and notifying affected consumers that it has "cured" the alleged violation and that no future violations will occur.

Fox 's CCPA litigation defense teams combine accomplished litigators with knowledgeable privacy and data security attorneys to protect clients against CCPA class and individual actions. Tenacious, well-versed in cybersecurity and strategic, Fox attorneys help clients make optimum use of all their options to minimize exposure in the event of a data breach.

The best way to avoid litigation is to prevent a data breach. Our Privacy & Data Security attorneys also advise businesses on cybersecurity best practices and CCPA compliance, helping them mitigate the overall risk of a breach, and lowering their exposure to class action lawsuits.

For more information, contact Privacy & Data Security Co-Chairs Elizabeth G. Litten at [email protected] | 609.895.3320 and Mark G. McCreary at [email protected] | 215.299.2010 or Gavin W. Skok, Partner in the firm's Litigation Department at [email protected]206.389.1731.