No.

“Consumers” can bring suit under the CCPA if they can prove the following five elements:

1. A business incurred a data breach;
2. The data breach involved a sensitive category of information identified in Cal. Civil Code Section 1798.81.5;
3. The business had a legal duty to protect the personal information from breach;
4. The business failed to implement reasonable security procedures and practices; and
5. The business’s failure resulted in (i.e., caused) a data breach.

While the common definition of “consumer” suggests that it refers to an individual that has “consumed” a product or a service in relation to a company, the definition ascribed by the CCPA is that a “consumer” is any “natural person who is a California resident.”¹  As a result individuals that are not residents of California are not permitted to bring suit under the statute.

For more information and resources about the CCPA visit http://www.CCPA-info.com.

This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes.  You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.

1. CCPA, Section 1798.140(g) (emphasis added).

[View source.]