Data Privacy in the Digital Age: The Risks and Opportunities of the California Consumer Privacy Act

The firm recently hosted a deep-dive presentation in Silicon Valley, San Francisco, and Los Angeles concerning the California Consumer Privacy Act (“CCPA”), which becomes effective on January 1, 2020.  Los Angeles partner Viola Trebicka and San Francisco partner Sam Stake presented a litigator’s perspective on what the CCPA’s challenges and opportunities will mean for companies doing business in California. 

            The CCPA—which economists have predicted could cost as much as $55 billion to implement—makes major changes to the legal privacy landscape in California by giving consumers important new rights in protecting their data privacy.  These include rights to notice upon collection or sale of personal data to file claims (for statutory, liquidated amounts) after data breaches, to opt out of the sale of consumer’s personal data to third parties, and to request that the consumer’s data be deleted altogether.  Each right has important exceptions, however, and the CCPA and its proposed regulations leave much room for interpretation by businesses and, ultimately, the courts.  

            One such area of interpretation is the exact contours of the “right to non-discrimination.”  Although, at first blush, the CCPA forbids companies from discriminating on the basis of a consumer’s exercise of those rights, the CCPA and the proposed regulations outline many different bases upon which companies can offer differentiating products, services, and prices to consumers.  Navigating the labyrinth of these exceptions will require astute legal and economic advice. 

            Another major aspect of the CCPA is the creation of a private right of action in the event of a data breach.  Importantly, the Act creates a $100 damages floor per incident, per consumer for a breach of unencrypted, identifying personal data that a company did not take reasonable steps to keep secure.   Multiplied by the number of affected consumers, the potential damages exposure can increase very quickly.  This potential for substantial statutory damages should give companies pause, and speaks to the value that a strong legal defense will provide in a post-CCPA world.