The California Consumer Privacy Act (CCPA) provides consumers with a private right of action if their nonencrypted or nonredacted personal information is subject to unauthorized access and exfiltration, theft, or disclosure as a result of a business’s” failure “to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information.” Cal. Civ. Code § 1798.150(a)(1). Under the law as amended by the California Privacy Rights Act, consumers can also bring a private cause of action for a data breach involving the leak of an email address in combination with a password or security question and answer that would permit access to the account. Cal. Civ. Code § 1798.150(d)(1)(B).  

Since its enactment, the CCPA has driven a significant volume of data privacy litigation, with over 145 cases filed alleging violations under the statute.1 The statute’s popularity among data breach plaintiffs can be traced to the damages it provides for private actions. Damages available for a private right of action under Section § 1798.150(a)(1) include a statutory amount of between $100 and $750 “per consumer per incident or actual damages, whichever is greater,” as well as injunctive or declaratory relief and “any other relief the court deems proper.” 

Instead of going to court, businesses and individuals can choose to use arbitration as an alternative method of resolving claims for monetary damages under the CCPA’s private right of action, although there are arguably limitations in arbitration on the availability of certain forms of non-monetary relief as contemplated by the statute. Arbitration involves the appointment of an arbitrator or a panel of arbitrators who hear evidence from both parties and make a final and binding decision.  There are several significant benefits to using arbitration to resolve CCPA’s private right of action, including: 

To read the full article, go to Daily Journal