Data Breach Claims Under California Law

What the Law Provides

Direct Answer: Section 1798.150 allows a consumer whose nonencrypted personal information is accessed or disclosed because of a business's failure to maintain reasonable security to recover damages.

Recovery can be actual damages or statutory damages, whichever is greater, per consumer per incident. The statute originally set the range at $100 to $750, and the figures are adjusted over time, so check the current amounts. Only certain types of information are covered, and the law applies to businesses that meet the statute's thresholds.

Notice and Cure

Before suing for statutory damages, a consumer must give the business 30 days' written notice identifying the violation. If the business cures the violation and confirms it in writing within that period, statutory damages are not available, though the statute states that improving security after a breach is not a cure. The notice requirement does not apply to claims for actual financial damages only.

Class Actions and Other Options

Because a breach usually affects many people, claims are often brought as class actions, which are covered by their own procedures. Residents of other states may have different protections, since breach notification and private rights of action vary, so the law that applies depends on where you live and the nature of the breach. Keep the breach notice you received and records of any losses such as fraud or identity theft costs.