Takeaways from CA Senate Judiciary Hearing on Bill That Would Expand CCPA’s Private Right of Action

On April 9, 2019, the California Senate Judiciary committee voted to advance SB 561, which would expand the private right of action to any violation of the CCPA (not just for negligent breaches) and would eliminate a business's 30-day right to cure. During the hearing, several senators expressed serious concerns with the bill as currently drafted and made clear they expect to see changes to the bill or will not vote to move the bill forward. The bill will next be heard by the appropriations committee, followed by a Senate floor vote, before it moves on to the House. Five consumer groups stated their support of the bill; twenty-two organizations – representing various industries including financial, nonprofits, entertainment and retail – opposed. Below are the key takeaways:

1. Senator Jackson acknowledged that the goal of the private right of action is to achieve compliance, not to punish businesses, and that this bill is an iterative process. Senator Jackson and the AG's office are committed to striking the right balance so that the private right of action does not destroy businesses. They are open to replacing the private right of action by expanding government enforcement through city attorneys, district attorneys, and county counsel, similar to the enforcement mechanism in California Business and Professions Code Section 17204. However, this would still allow actions for any violation of the statute, not just for negligent breaches.
2. Senator Caballero voiced concerns about how the CCPA, and SB 651 in particular, will affect small businesses and startups, especially since California is a leader in innovation. The expanded private right of action may chill innovation and creativity.
3. Senator Borgeas stated that SB 561 would be like taking a "sledgehammer" to businesses. The regulations from the AG's office to which businesses will be looking for guidance are not expected to be promulgated until sometime after January 1, 2020, yet businesses may be subject to a lawsuit before the regulations come out. This may be "red meat" to the plaintiff's bar. Senator Borgeas also raised concerns that while the private right of action is intended to alleviate the burden on the AG's office, it may flood the courts with lawsuits.
4. Senator Stern conceptualized enforcement options for the CCPA as having three "doors": Door #1 – the private right of action in SB 561; Door #2 – an enforcement mechanism similar to the California Business and Professions Code Section 12704; and Door #3 – a "compliance culture" like the European Union where enforcement would be focused on providing notices to businesses, audits, and warnings.