The California Consumer Privacy Act provided plaintiffs with a private right of action to pursue statutory damages following data security breaches that impact certain sensitive categories of information and are caused by a business’s failure to institute reasonable and appropriate security. Although the CCPA does not permit private suits with respect to alleged violations of the CCPA’s privacy (as opposed to security) provisions, the lack of a specified private right of action has not deterred some plaintiffs from filing suit. Based upon a review of federal class actions filed in 2020 that referenced either “CCPA” or “California Consumer Privacy Act,” plaintiffs focused most heavily on bringing CCPA-related lawsuits against the health care and health services industries. Indeed, nearly one in five class actions was filed against a health care-related company.
What industry is most at risk for CCPA litigation? Hint: It’s not what you think!
