California Senate Committee Blocks Bill to Expand CCPA's Right to Bring Lawsuits

Private California Senate Bill 561, which we reported on previously, would have added a private right of action to allow individuals to bring suits to enforce the California Consumer Privacy Act (CCPA), but failed to advance out of the Senate Appropriations Committee on Thursday. This procedural setback likely guarantees that the amendment will not be part of the law when the CCPA takes effect on Jan. 1, 2020. 

The current version of the enacted law provides for a narrow private right of action for consumers whose personal information “is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’ violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information.” But the existing private enforcement right is limited to data breaches and does not apply to the general privacy rights granted to consumers under the law. 

Proponents of SB 561 argued that the Attorney General’s office, with its limited resources, would be unable to effectively police and enforce the law given the number of businesses that will be subject to the new privacy regime. As a result, proponents feared that businesses will not fully comply with the CCPA’s requirements. Meanwhile, opponents of giving consumers the right to bring their own lawsuits under the law fear that a private right of action would result in a flood of frivolous class action claims due to minor noncompliance stemming from ambiguities in the law.

The proposed amendment had also sought to eliminate the 30-day cure period for noncompliance as well as remove the right that companies have to seek individualized opinions from the Attorney General on compliance questions under the CCPA.

We will continue to monitor developments and provide updates as the California legislature considers other amendments to the CCPA.