The CCPA permits consumers to “institute a civil action” only where certain types of personal information are “subject to an unauthorized access and exfiltration, theft, or disclosure.”1 The CCPA does not provide a private right of action, nor does it provide statutory damages, if a business violates its obligation to provide notice concerning its privacy practices.2
The California Unfair Competition Law (UCL) defines “unfair competition” as including “any unlawful, unfair, or fraudulent business act or practice.”3 Plaintiffs’ attorneys in California have historically attempted to use the UCL to bring suit against companies that allegedly violated any other California or federal law by arguing that the secondary violation constituted an “unlawful” practice for which the UCL might permit recovery. However, such a strategy may not succeed in connection with the CCPA, as the Act expressly states that “[n]othing in this title shall be interpreted to serve as the basis for a private right of action under any other law.”4
An amendment to the CCPA – Senate Bill 561 – was proposed which, had it passed, would have extended the private right of action to all alleged violations of the CCPA. While the amendment received the endorsement of the California Attorney General, on May 16, 2019, it was held in committee under submission pending fiscal review. As of the date of this post the amendment had not been enacted. During the rulemaking process the California Attorney General was separately requested to “[i]nclude a private right of action in the regulations” to the CCPA. The Attorney General declined, stating that he lacked the authority to “implement regulations that alter or amend a statute” and specifically noted that “the Legislature declined to pass SB 561.”5
1 Cal. Civ. Code 1798.150(a)(1).
2 Cal. Civ. Code 1798.110(c); 1798.115(c); 1798.130(a)(5). Note, however, that the CCPA does permit the California Attorney General to pursue civil penalties.
3 Cal. Bus. & Prof. Code 17200.
4 Cal. Civ. Code 1798.150(c).
5 FSOR Appendix A at 310 (Response 920).