With the California Consumer Privacy Act (CCPA) – the strictest privacy law in the nation – now in effect, an important question for businesses to consider is whether it applies to conduct that occurred prior to the law's effective date of Jan. 1. This question is particularly relevant to the private right of action section of the CCPA, Section 1798.150.
Section 1798.150 provides consumers with a private right of action based on a "business's violation of the duty to implement and maintain reasonable security procedures" resulting in "unauthorized access and exfiltration, theft, or disclosure" of the consumer's nonencrypted or nonredacted personal information. Cal. Civil Code § 1798.150. A "business" is defined as any entity that (1) has annual gross revenue of over $25 million; (2) buys, sells or shares the personal information of 50,000 or more consumers per year; or (3) derives 50 percent or more of its annual revenue from selling consumers' personal information. Id. at § 1798.140. Under Section 1798.150, a consumer may recover damages of between $100 and $750 per violation or their actual damages, whichever is greater. They can also seek injunctive or declaratory relief or any other relief the court deems proper. Id. at § 1798.150.
Section 1798.150 is not expressly retroactive; that is, it does not expressly apply to conduct that took place prior to Jan. 1. A retroactive law is one that "affects rights, obligations, acts, transactions and conditions which are performed or exist prior to the adoption of the statute." Aetna Cas. & Sur. Co. v. Indus. Accident Comm'n, 182 P.2d 159, 161 (Cal. 1947) (internal quotations and citations omitted). Under California law, "[i]t is an established canon of interpretation that statutes are not to be given a retrospective operation unless it is clearly made to appear that such was the legislative intent." Id. Further, Section 3 of the California Civil Code, which governs the CCPA, provides that "[n]o part of [this code] is retroactive, unless expressly so declared." Cal. Civ. Code § 3.
The "leading modern California decision on th[is] subject" is Aetna. Evangelatos v. Superior Court, 753 P.2d 585, 639 (Cal. 1988). There, an employee was injured, and he applied for an award of compensation from the California Industrial Accident Commission. Aetna Cas. & Sur. Co., 182 P.2d at 160. At the time of the injury, the California Labor Code provided for a lower compensation award; however, at the time the commission decided the employee's case, an amendment went into effect that provided for a higher award. Id. The commission made its award pursuant to the terms of the amended statute. Id. Aetna filed suit, arguing that the commission should have applied the version of the statute that was in effect at the time of the employee's injury. The California Supreme Court agreed. Id. at 161. The court reasoned that "statutes are not to be given a retrospective operation unless it is clearly made to appear that such was the legislative intent." Id. It also noted that retrospective operation "cannot be implied from the mere fact that the statute is remedial and subject to the rule of liberal construction." Id. at 162.
Here, because Section 1798.150 does not contain an express retroactivity provision, it is unlikely that a court would apply it to conduct that occurred prior to Jan. 1. Additionally, Aetna suggests that the mere fact that the CCPA "shall be liberally construed to effectuate its purposes" does not imply that the statute is retroactive. See Cal. Civ. Code § 1798.194. There are two important caveats to note, however. First, this issue has not yet been litigated; therefore, there is uncertainty about how courts will ultimately decide it. Second, there are other provisions of the CCPA that contain a 12-month lookback. For example, Section 1798.130, in conjunction with sections 1798.110 and 1798.115, gives consumers the right to request that businesses that collect or sell personal information disclose that information upon the receipt of a verifiable consumer request. Id. at §§ 1798.130, 1798.110, 1798.115. The disclosure "shall cover the 12-month period preceding the business's receipt of the verifiable consumer request . . ." Id. at § 1798.130. It is not yet clear how these provisions will interface with the private right of action, if at all, but we will continue to monitor this issue.
The CCPA will have a significant impact on businesses across the country that buy, sell or share personal data. Undoubtedly, consumers will attempt to bring suit against businesses for purported violations of the CCPA that took place prior to Jan. 1. However, based on the California Supreme Court's decision in Aetna, at this preliminary stage, businesses would appear to have a strong defense against such litigation.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.