News & Events

California Refines Consumer Privacy Rights and Creates a Private Right of Action for Data Breaches

7.16.19

The California Consumer Privacy Act (CCPA) is set to take effect January 1, 2020. This new act outlines the fundamental rights of individuals whose personal information data is subject to collection from companies who meet the Act’s definition. Data subjects will now have the following fundamental rights under California law:

1. The right to know about the collection and sale of their information, including type of data collected, the source of the information, the third parties with whom the information is shared, and the purposes of its use.

2. The right to access a copy of the information that has been collected or sold.

3. The right to request the company to delete personal information that has been collected (albeit the company may refuse such request under certain exceptions).

4. The right to direct a company to stop selling their information.

5. The right to be free from discrimination as a result of exercising their rights under the CCPA.

6. The right to parental or guardian consent if the data subject is younger than the age of 13. If the data subject is between the ages of 13 and 15, the company need only obtain the child’s consent. Consent is not required for data subjects 16 and older.

7. The right to sue for a data breach. The data subject may sue, following a 30-day cure period, when the company failed to implement and maintain reasonable security procedures and practices resulting in the unauthorized access and exfiltration, theft, or disclosure of personal information.

Companies in violation of the CCPA may be fined up to $2,500 for each negligent violation or up to $7,500 for each intentional violation. Companies should not procrastinate. Begin creating a CCPA compliance strategy now, if one is not already in place, or review and revise your processes to ensure compliance with the new law. In addition, companies will be required to update their privacy notices regarding data subject to California law.

Danielle Jenkins is an attorney in the Firm’s Franchise Law & Business Litigation Practice Groups. If you have any questions or concerns about this issue or any other matter, please contact Danielle directly at 813-223-1099.

Related Attorney
Danielle Diller

Related Attorney

Danielle Diller

< Back to News & Events