The CCPA’s Private Right Of Action -

The CCPA gives consumers several new “Privacy Rights”—such as the right to know how their personal information is collected, used and shared, the right to request deletion of their personal information, and the right to opt-out of “sales” of their personal information. But the act doesn’t give consumers the right to sue for a violation of Privacy Rights. The private right of action is limited to the “Security Right,” which is only violated if sensitive categories of personal information are “subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices.” If consumers prove such a violation, the court may award (i) statutory damages up to $750 per consumer per incident, or actual damages, whichever is greater, (ii) injunctive or declaratory relief, and (iii) any other relief the court deems proper.