The CCPA permits consumers to “institute a civil action” only where consumer “nonencrypted or nonredacted personal information” is “subject to an unauthorized access and exfiltration, theft, or disclosure.”  The CCPA does not provide a private right of action, nor does it provide statutory damages, if a company violates its obligation to disclose to consumers information about their data upon request, or fails to provide “the specific pieces of personal information” collected about a consumer. In other words, the CCPA does not envision that consumers can bring suit if a business fails to respond in time to an access request, or fails to include each piece of personal information that was collected from the consumer.
 Cal. Civ. Code 1798.150(a)(1).
 Cal. Civ. Code 1798.110(a)(5). Note, however, that the CCPA permits the California Attorney General to pursue civil penalties.