Expanded CCPA Private Right of Action Fails, But Threat of Private CCPA Claims May Not Be Over

Tech companies claimed victory last week when California’s Senate Bill 561 was blocked in the Senate. SB 561 would have amended the California Consumer Privacy Act (“CCPA”) to expressly grant plaintiffs the right to sue for all CCPA violations and most likely set in motion a wave of litigation beginning early next year. This is a positive development for businesses scrambling to comply with CCPA, but it doesn’t necessarily eliminate the threat of private CCPA litigation.

In its current form, CCPA limits private claims to breaches of unencrypted or unredacted data caused by a business’s failure to implement and maintain reasonable information security practices. Otherwise, CCPA leaves enforcement of the Act to the California Attorney General. Fines and penalties for CCPA violations can be steep, but the California AG’s office has acknowledged that resource constraints may limit its ability to adequately enforce the law. Consequently, the California AG’s office was a strong proponent of SB 561.

SB 561’s failure will stem the tide of private CCPA litigation to an extent, but creative plaintiffs will look for other ways to pursue CCPA claims in court. California’s Unfair Competition Law (“UCL”) (Cal. Bus. & Prof. Code § 17200, et seq.) permits private plaintiffs to sue for business practices that are “unlawful,” “unfair,” or “fraudulent,” and may provide an alternative to CCPA’s express private right of action.

Specifically, UCL’s unlawful prong has been an avenue for plaintiffs to pursue private claims under statutes that lack their own private right of action, but the California Supreme Court has limited this where the legislature specifically intends to preclude a private right of action. Therefore, CCPA’s explicit statement that (other than the data breach private right of action) it is not intended to “serve as the basis for a private right of action under any other law” could preclude UCL unlawful claims, but this will likely be tested in the courts.

Ultimately, it is difficult to be certain how CCPA private claims will play out in the courts. As such, businesses subject to CCPA requirements would be wise to focus on the development of their compliance plan (here are some ways to get started) as that will be the best way to limit exposure to CCPA claims.