A CCPA Private Right of Action on the Horizon

The first part of this article provides an overview of how the CCPA addresses private rights of action. The second section summarizes recent class action complaints that attempt to use CCPA violations as the basis for class-wide claims, either via claims asserted directly under the CCPA or through the California Unfair Competition Law. The third and final part provides suggestions for prioritizing activity in CCPA compliance programs in this new litigation environment.

Part One: The CCPA and Private Rights of Action

The California Consumer Privacy Act was the end product of a negotiation with the backers of a proposed ballot initiative, Californians for Consumer Privacy, that, if successful, would have granted California residents the right to be notified of and to opt out from sales of personal information. See, The California Consumer Privacy Act of 2018, Ballot Initiative No. 17-0027, draft stamped as received by California Attorney General on Oct. 9, 2017. One of the primary objectives of the business community in supporting the negotiations was to eliminate a proposed private right of action. See, California Senate, Senate Judiciary Committee, Tuesday, April 9^th, 2019 at 3:34:00-3:39:25. The final statute, a product of compromise on both sides, promised to limit any private right of action to claims for certain data security incidents resulting from a failure to comply with pre-existing standards of California law. See, Cal. Civ. Code §1798.81.5. Privacy attorneys and litigators were, however, quickly skeptical about whether the compromise language would be effective to preclude broader class action suits.