The provision authorizes claims where nonencrypted and nonredacted personal information was subject to unauthorized access due to failure to maintain reasonable security. Statutory or actual damages are available, whichever is greater.
A thirty-day cure period applies to injunctive claims.
Alternative Names:
CCPA Cause of Action|Section 1798.150 Claim
Why it Matters?
Encryption is a complete defense to the private right of action, since the provision reaches only nonencrypted and nonredacted information, which makes encryption at rest a direct litigation control rather than only a compliance measure. The covered data categories are also narrower than the statute's general personal information definition. Both limitations are threshold defenses preceding any reasonableness inquiry.
Frequently Confused with
Related terms
Frequently asked questions
Is encryption a defense?
What does the cure period cover?
