California Civil Code

§ 1798.150

CIV § 1798.150 Effective Jan 1, 2025Div. 3 · Title 1.81.5 · Part 4

Statute text

Personal Information Security Breaches

(a)(1) Any consumer whose nonencrypted and nonredacted personal information, as defined in subparagraph (A) of paragraph (1) of subdivision (d) of Section 1798.81.5, or whose email address in combination with a password or security question and answer that would permit access to the account is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’ violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action for any of the following:

(A)To recover damages in an amount not less than one hundred dollars ($100) and not greater than seven hundred and fifty ($750) per consumer per incident or actual damages, whichever is greater. The amounts in this subdivision shall be adjusted pursuant to subdivision (d) of Section 1798.199.95.

…

Legislative history

Amended by Stats. 2024, Ch. 121, Sec. 6. (AB 3286) Effective January 1, 2025.