CCPA Security FAQs: Does the CCPA identify a minimum statutory damage that must be awarded?


Section 1798.150 of the CCPA permits consumers to “institute a civil action” if consumer “personal information, as defined in subparagraph (A) of paragraph (1) of subdivision (d) of Section 1798.81.5, is subject to unauthorized access and exfiltration, theft, or disclosure,” and where that unauthorized access was “a result of the business’s violation” of a duty to “implement and maintain reasonable security procedures and practices . . . .” 1  If a plaintiff is successful in bringing such a suit, the CCPA states that the plaintiff can recover damages “in an amount not less than one hundred dollars ($100) . . . per consumer per incident. . . .”2