While much has been written about the California Consumer Privacy Act (“CCPA”), the focus has primarily been on the new rights it affords California consumers to have access to and control use of their data and opt out of many transfers to third parties. While this is a sea change in data privacy legislation in the United States, perhaps the greatest risk to businesses covered by the CCPA is that the CCPA creates a private right of action – with substantial statutory damages – for data breaches. This change will likely reset litigation risks in California in the post-data-breach context and may have significant implications for data breach litigation across the country.
Jim Harvey, Gavin Reinke, and Kaeley Brown recently released a Cyber Advisory that examines these issues in depth, which you can visit here.