Our Digital Assets and Data Management teams have been tracking all aspects of the CCPA, so when Fuentes v. Sunshine Behavioral Health Group, LLC (Case No. 8:20-cv-00487, Central District of California) was filed on March 10, 2020, alleging a direct claim for violation of the CCPA, we were interested to see how CCPA allegations are being alleged directly, rather than as predicate violations for other claims. The lawsuit alleges that on Sept. 4, 2019, Sunrise learned it was experiencing an incident involving approximately 3,500 patients. This filing confirms our earlier predictions about how the CCPA would likely result in more filings related to incidents involving relatively few persons due to the statutory penalties potentially available.

Assuming the allegations in the complaint are true, this case may be one testing ground for the retroactivity question relating to the CCPA. We previously discussed this issue, noting that Section 1798.150 of the CCPA is not expressly retroactive and does not expressly apply to conduct that took place prior to Jan. 1, 2020, but that the CCPA’s 12-month lookback, combined with entrepreneurial plaintiffs’ counsel, could lead to lawsuits over data incidents predating 2020.

This case may also provide one opportunity for courts to test the viability of stacking statutory penalty claims, because the lawsuit alleges statutory violations not only under the CCPA but also under the California Confidentiality of Medical Information Act (CMIA). We have previously identified some areas for parallel analysis in these two hearty California statutes, noting that courts may look to the judicial interpretation of the CMIA when considering the application of the CCPA out of the gate.

Finally, it is worth noting that the plaintiff in this case specifically pled that he provided notice to Sunrise prior to filing the complaint. We have discussed the general notice and cure requirements of the CCPA, noting the likely challenges in pleading the cure. Here, plaintiff merely stated that he notified Sunshine, and then he alleges that he is seeking relief “[i]f Defendant fails to respond to Plaintiff’s notice letter or agree to rectify the violations” in the complaint.

We will continue to follow this and any other similar cases as CCPA litigation progresses, especially in cases originating from the past.