CCPA (California Consumer Privacy Act)
A 2018 California law, strengthened in 2023, that gives consumers rights over their data and, after a breach caused by inadequate security, opens an action for statutory damages that multiplies class action risk.
The California Consumer Privacy Act, enacted in 2018 and applicable since January 1, 2020, then amended by the California Privacy Rights Act applicable since 2023, is the most influential data protection law in the United States, in the absence of a general federal law. It gives California residents rights comparable to those under European law: to know what data is collected, request deletion, opt out of sale or sharing, and have it corrected. A dedicated agency, created by the 2023 amendment, enforces it. Its most important provision for insurance is a private right of action: when personal data is stolen or disclosed as a result of the business's failure to maintain reasonable security measures, each affected consumer may claim statutory damages of 100 to 750 dollars per incident, without having to prove harm. Multiplied by the number of people affected, this schedule turns a data breach into a considerable liability exposure, and it has made California the reference jurisdiction for data breach class actions.
Textbook case: a data breach affects 200,000 California residents. If a court finds a failure of reasonable security, statutory damages range from 20 to 150 million dollars before any harm is shown, which in practice pushes the company and its insurer toward settlement.
CCPA, California Consumer Privacy Act, CPRA
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.