CCPA Amendment Expands Private Right to Action

April 24, 2019

SB 561 was introduced on
February 22, 2019
CCPA is still evolving
Have you assessed your compliance readiness?
CCPA become effective January 1, 2020, are you ready?

Senate Bill  SB 561
CCPA Moves Forward
Expands the CCPA Private Right of Action 
Want more information on Senate Bill 561

California Senator Hannah Beth-Jackson introduced SB 561 that would amend the California Consumer Privacy Act of 2018 (“CCPA”) private right of action clause in the bill and remove the 30-day cure period requirement for enforcement actions brought by the State Attorney General. The new amendment does not change the January 1, 2020 compliance effective date.

Private Right of Action
  • Expand the civil right of action for damages to apply to any consumer whose rights under the CCPA are violated.
  • Under CCPA the private right of action is currently limited to instances in which a consumer’s nonencrypted or nonredacted personal information is subject to unauthorized access and exfiltration, theft or disclosure as a result of a business’s failure to maintain reasonable security procedures.
  • If SB 561 is passed consumers whose rights are violated under CCPA can bring a private right of action against a business.
  • No other sections of the private right of action provision would change.

Penalties for violations of the Act remain unchanged:
  • $100-$750 per consumer per incident or actual damages, whichever is greater;
  • Injunctive or declaratory relief; and
  • Any other relief the court deems proper.
  • 30-day cure period provision remains unchanged:

Actions involving statutory damages:
  • Consumers must still provide a business with 30 days’ written notice and an opportunity to cure the violation.
  • If within the 30 days the business cures the violation and provides the consumer an express written statement that the violations have been cured and that no further violations shall occur, the consumer would be barred from bringing an action for individual statutory damages or class-wide statutory damages.
Actions involving actual damages:
  • Under the current language in the CCPA, a consumer is not required to provide a business with 30 days’ notice and an opportunity to cure.

CCPA Enforcement
  • Remove the 30-day cure period for enforcement actions brought by the California Attorney General.
  • CCPA currently states that a business will be in violation of the law if it fails to cure any alleged violation of the CCPA within 30 days after being notified of alleged noncompliance. SB 561 would remove this provision, allowing the California Attorney General to bring enforcement actions for violations of the CCPA even when a business has “cured” the alleged violations.
  • End the ability to seek guidance from the California Attorney General about how to comply with the CCPA.
    • The CCPA currently provides the opportunity for any business or third party to seek the opinion of the California Attorney General for guidance on how to comply with the CCPA.
    • SB 561 would eliminate this provision and the Attorney General “may publish materials that provide businesses and others with general guidance” on how to comply with the CCPA.
    • Injunction; and civil penalties of up to $2,500 for each violation or $7,500 for each intentional violation would remain the same. However, if passed, the expanded private right of action provision would significantly increase businesses’ liability risks under the CCPA.

The amendment is supported by California Attorney General Xavier Becerra, who characterizes it as “a critical measure to strengthen and clarify the CCPA.” Enforcement actions for CCPA won’t start until July 1, 2020; however, consumers may pursue private rights of action beginning on January 1, 2020 when the law goes into effect. Businesses therefore should be prepared to comply with the CCPA by January 1, 2020.