CCPA §1798.150 — Private Right of Action
Enforced by: California AG
Current as of January 1, 2020
Plain Language Summary
CCPA private right of action for data breaches: $100–$750 per person per incident or actual damages, whichever is greater. Class action risk is significant.
Any consumer whose nonencrypted and nonredacted personal information is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business's violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information may institute a civil action.
The consumer may recover damages in an amount not less than $100 and not greater than $750 per consumer per incident or actual damages, whichever is greater, injunctive or declaratory relief, and any other relief the court deems proper.