Companies that do business in California can expect to see class action litigation if they become the victim of a data breach, but showing a good cybersecurity posture and implementing arbitration agreements may be the best defense.

"I think those of us on the defense side are speculating over whether it's going to be [on] Jan. 1 or Jan. 2," Anne Johnson Palmer, a partner at Ropes & Gray in San Francisco, said. "Any company that experiences a data breach is likely to see one of these cases."

Since June 28, 2018, the California Consumer Privacy Act has undergone several changes. Most notably, consumers now only have a private right of action for a data breach. If the suit is successful, consumers who have their data exposed in a breach can be given anywhere from $100 to $750.

"There is the private right of action and the statutory damages. That is new and a game changer because defendants have historically challenged these data breach class actions on the basis that there isn't a sufficient allegation about damage or injury," Palmer explained.

She said because there are damages built into the statute, companies may have a harder time challenging the validity of any class action which arises from a data breach. As the law stands now, there is only a private right of action for a data breach and no other part of the statute.

Michelle Hon Donovan, a partner at Duane Morris in San Diego, said in-house counsel should begin looking at their consumer-facing agreements and find ways to get around a class action lawsuit. One of those measures would include adding an arbitration provision to the online agreements.

"You have to get the consumers to agree," Donovan said. "The companies can't just change their terms. That is going to be one of the big things to protect themselves against class action lawsuits."

Donovan said the language of the CCPA "appears to be making an attempt to circumvent" a contractual provision such as an arbitration agreement. However, she noted the CCPA does say that the act will not apply if the application is preempted by federal law. She said the U.S. Supreme Court case Kindred Nursing Centers v. Clark would preempt the CCPA's attempt to circumvent arbitration agreements. In Kindred, she explained, the court ruled that federal arbitration law preempts any state laws that attempt to limit arbitration.

"If you just put it on your website, it is not going to be enforceable," Donovan said.

Palmer added it's important to show how a company has been improving its cybersecurity and to create internal policies in the event of a data breach.

"Focus on data security to have a record to be able to demonstrate that you have a security posture," Palmer said.

Even if companies are prepared for the CCPA, those responsible for compliance and regulation should be keeping an eye on what other states are doing.

"The one thing that is becoming an emerging area is that other states are following the lead of California and enacting their own laws," Palmer said. "The CCPA is the first phase of a frontier of state statutes in this area. The CCPA is not going to be standing alone as time passes."