Private Rights of Action and the CCPA—Unlimited Limitation?
In creating that private right of action, the act specifically notes that violations "shall not be interpreted to serve as the basis for a private right of action under any other law."
May 05, 2020 at 11:55 AM
6 minute read
As we are all well aware by now, the California Consumer Privacy Act (CCPA) (Cal. Civ. Code Sections 1798.100 et seq.) went into effect on Jan. 1. Through its amendments and regulations (the latter of which have yet to be finalized as of this article's publication), one aspect of the act has stayed largely consistent: the CCPA grants a private right of action only in limited situations. While the California Attorney General has the ability to impose fines for any CCPA violation, the private right of action is specifically limited (over significant debate and a proposed amendment that failed to pass) to data breach. Moreover, in creating that private right of action, the act specifically notes that violations "shall not be interpreted to serve as the basis for a private right of action under any other law."
Does that mean there will not be significant litigation concerning the CCPA outside of the data breach realm? The answer is clearly a resounding "no." Indeed, we have already seen multiple lawsuits filed taking direct aim at the CCPA's claimed limitations on private enforcement. In those cases, in direct contravention of the stated limitation on private rights of action, plaintiffs have claimed (among other things) that the failure to provide proper notice required by the CCPA predicates a violation of California's Unfair Competition Law (Cal Civ. Code. Section 17200) (the UCL). See, e.g., Burke v. Clearview AI, Case No. 3:20-cv-00370 (S.D. Cal., filed Feb. 27, 2020); Sheth v. Ring, Case No. 2:20-cv-01538 (C.D. Cal., filed Feb. 18, 2020). Whether such claims will fail as expressly barred by the act remains to be seen.
But there are at least two additional areas where we expect to see the CCPA used in actions brought by plaintiffs' attorneys: (i) in connection with suits brought on behalf of cities and counties to enforce provisions of the CCPA, and (ii) where privacy statements and advertised activities required by the CCPA do not match the company's actual practices, and thus potentially amount to actionable false claims under California's false advertising law (the FAL) (Cal. Civ. Code Section 17500) and the California Consumers Legal Remedies Act (the CLRA) (Cal. Civ. Code Section 1750).
The past has shown that such laws provide fertile soil for consumer protection lawsuits, and we expect the CCPA to provide rich humus for a bumper crop of related enforcement claims.
Cities and Counties
The CCPA's limitation on actions specifically limits "private" actions. Actions brought by cities and counties, then, are necessarily permitted under the act. Indeed, such governmental entities are likely to see this provision of the act as an opportunity to protect their constituents at no cost, since plaintiffs attorneys may be willing to take such cases on a contingency basis. Alternatively, cities and counties may find opportunities to engage counsel on a low-cost or hybrid fixed rate/contingency basis, a common practice in California. This type of engagement is permissible so long as the plaintiff city/county maintains supervisory control of the action (often by acting as co-counsel) while enforcing the rights of its residents. In connection with the CCPA, we had expected to see cities and counties taking a large role in enforcement, and in the new economic landscape created by the COVID-19 pandemic, alternative fee relationships are likely to be an attractive vehicle of resident protection for resource-strapped city and county departments to protect consumers without diverting resources away from other pressing health and safety mandates.
False Claims
The CCPA may also provide opportunities for plaintiffs attorneys to act on behalf of private citizens in claims not expressly based on a violation of the CCPA. As above, several such lawsuits have already been filed alleging violations of the UCL. Additional areas ripe for litigation are likely to include claims based on the FAL and the CLRA. These statutes, and potentially others, are likely to provide particularly fertile ground where, in their rush to comply with the CCPA notice and disclosure requirements described in Cal. Civ. Code Section 1798.130 (a)(5), businesses post privacy policies that later are exposed as not entirely accurate.
The FAL provides a cause of action against any person or company that, in the course of promoting or advertising a product, service, or business, makes a public statement that the speaker knows or should know is untrue or misleading. See generally, Cal. Bus. & Prof. Code Section 17500. Similarly, the CLRA prohibits "unfair methods of competition and unfair or deceptive acts or practices" by a business. Cal. Civ. Code Section 1770(a). Statements made concerning the collection, storage, use, and sharing of personal information as provided in an online privacy policy would surely support such claims where the statements, while arguably satisfying CCPA requirements, are demonstrably false or misleading.
The CLRA, which allows consumers to bring class action lawsuits to recover damages and enjoin false and unfair business practices, also provides for the recovery of punitive damages and attorney fees, making it a preferred vehicle for consumer protection claims.
While the attorney general's enforcement will likely begin with review of company policies to ensure the company has provided the disclosures and notices required by the CCPA, consumer protection attorneys will no doubt be digging deeper sooner to investigate whether the company's practices align with its stated policies. As such, it is imperative that companies don't merely post privacy policies that meet the CCPA requirements, but rather they ensure that the policies they post fully and faithfully reflect the company's practices.
The overall impact of the CCPA's limitations on private actions is not clear. But we expect the new privacy landscape will provide a new and rich harvest for consumer protection attorneys.
Nate Garhart is special counsel, Julia Kropp is a senior associate and Ashley Roybal-Reid is an associate at Farella Braun + Martel.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllState Appeals Court Revives BraunHagey Lawsuit Alleging $4.2M Unlawful Wire to China
3 minute readApple Disputes 'Efforts to Manufacture' Imaging Sensor Claims Against iPhone 15 Technology
Lawsuit alleges racial and gender discrimination led to an Air Force contractor's death at California airfield
7 minute readLaw Firms Mentioned
Trending Stories
- 1We the People?
- 2New York-Based Skadden Team Joins White & Case Group in Mexico City for Citigroup Demerger
- 3No Two Wildfires Alike: Lawyers Take Different Legal Strategies in California
- 4Poop-Themed Dog Toy OK as Parody, but Still Tarnished Jack Daniel’s Brand, Court Says
- 5Meet the New President of NY's Association of Trial Court Jurists
Who Got The Work
J. Brugh Lower of Gibbons has entered an appearance for industrial equipment supplier Devco Corporation in a pending trademark infringement lawsuit. The suit, accusing the defendant of selling knock-off Graco products, was filed Dec. 18 in New Jersey District Court by Rivkin Radler on behalf of Graco Inc. and Graco Minnesota. The case, assigned to U.S. District Judge Zahid N. Quraishi, is 3:24-cv-11294, Graco Inc. et al v. Devco Corporation.
Who Got The Work
Rebecca Maller-Stein and Kent A. Yalowitz of Arnold & Porter Kaye Scholer have entered their appearances for Hanaco Venture Capital and its executives, Lior Prosor and David Frankel, in a pending securities lawsuit. The action, filed on Dec. 24 in New York Southern District Court by Zell, Aron & Co. on behalf of Goldeneye Advisors, accuses the defendants of negligently and fraudulently managing the plaintiff's $1 million investment. The case, assigned to U.S. District Judge Vernon S. Broderick, is 1:24-cv-09918, Goldeneye Advisors, LLC v. Hanaco Venture Capital, Ltd. et al.
Who Got The Work
Attorneys from A&O Shearman has stepped in as defense counsel for Toronto-Dominion Bank and other defendants in a pending securities class action. The suit, filed Dec. 11 in New York Southern District Court by Bleichmar Fonti & Auld, accuses the defendants of concealing the bank's 'pervasive' deficiencies in regards to its compliance with the Bank Secrecy Act and the quality of its anti-money laundering controls. The case, assigned to U.S. District Judge Arun Subramanian, is 1:24-cv-09445, Gonzalez v. The Toronto-Dominion Bank et al.
Who Got The Work
Crown Castle International, a Pennsylvania company providing shared communications infrastructure, has turned to Luke D. Wolf of Gordon Rees Scully Mansukhani to fend off a pending breach-of-contract lawsuit. The court action, filed Nov. 25 in Michigan Eastern District Court by Hooper Hathaway PC on behalf of The Town Residences LLC, accuses Crown Castle of failing to transfer approximately $30,000 in utility payments from T-Mobile in breach of a roof-top lease and assignment agreement. The case, assigned to U.S. District Judge Susan K. Declercq, is 2:24-cv-13131, The Town Residences LLC v. T-Mobile US, Inc. et al.
Who Got The Work
Wilfred P. Coronato and Daniel M. Schwartz of McCarter & English have stepped in as defense counsel to Electrolux Home Products Inc. in a pending product liability lawsuit. The court action, filed Nov. 26 in New York Eastern District Court by Poulos Lopiccolo PC and Nagel Rice LLP on behalf of David Stern, alleges that the defendant's refrigerators’ drawers and shelving repeatedly break and fall apart within months after purchase. The case, assigned to U.S. District Judge Joan M. Azrack, is 2:24-cv-08204, Stern v. Electrolux Home Products, Inc.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250