CCPA Makes First Court Appearance

The California Consumer Privacy Act (CCPA) has been in effect only since January 1, but it has already been cited in a lawsuit, apparently for the first time. On February 3, plaintiffs filed a class action complaint in the US District Court for the Northern District of California against retailer Hanna Andersson, LLC and Salesforce.com, Inc., over a data breach suffered by Hanna Andersson. The complaint makes only passing reference to the CCPA and does not rely on it as the basis for a claim, because the breach happened in 2019, before the CCPA took effect. Still, the citation is worth noting, since the CCPA provides for statutory damages where a company's failure to implement reasonable security practices results in a data breach. The CCPA thus promises to make data breaches much more costly for victim companies. Retailers and other companies should look at the citation of the CCPA in Barnes v. Hanna Andersson, LLC as a shot across the bow, and be sure that their data security practices are up to...