A data breach lawsuit is a civil case against the company that held personal information that was exposed. A breach notice alone does not establish a claim, and whether a particular situation gives rise to one depends on its facts and on the law that applies.
This page explains what a data breach lawsuit is, what California's Cal. Civ. Code § 1798.150 provides on the conditions it states, and which federal credit-file protections a consumer may use under 15 U.S.C. § 1681c-1.
What a Data Breach Lawsuit Is
A data breach is unauthorized access to, or taking of, personal information that a company holds. That information might be names and Social Security numbers, health records, bank or card numbers, or login details.
A data breach lawsuit is a civil case. A person whose information was exposed brings it against the company that was responsible for protecting that information. The person bringing the case is the plaintiff. The company is the defendant.
Receiving a breach notice tells a person that an exposure happened. It does not, by itself, establish that the person has a claim. Whether a particular situation gives rise to a claim depends on its facts and on the law that applies.
California's Statutory Claim for Certain Breaches
California has its own rule in Cal. Civ. Code § 1798.150. Under it, a consumer may institute a civil action if the consumer's nonencrypted and nonredacted personal information, as defined in subparagraph (A) of paragraph (1) of subdivision (d) of Cal. Civ. Code § 1798.81.5, or the consumer's email address in combination with a password or security question and answer that would permit access to the account, is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business's violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect it.
The statute lists three kinds of relief a consumer may seek in that action: damages in an amount not less than $100 and not greater than $750 per consumer per incident or actual damages, whichever is greater; injunctive or declaratory relief; and any other relief the court deems proper. The statute provides that the dollar amounts are adjusted under subdivision (d) of Cal. Civ. Code § 1798.199.95. In assessing the amount of statutory damages, the court must consider any one or more of the relevant circumstances presented by any of the parties, including the nature and seriousness of the misconduct, the number of violations, the persistence of the misconduct, the length of time over which it occurred, its willfulness, and the defendant's assets, liabilities, and net worth. These are what the statute allows a court to award in such an action, not an amount that any particular person will receive.
Statutory damages carry a notice condition. An action under the section may be brought if, before initiating any action against a business for statutory damages on an individual or class-wide basis, the consumer provides the business 30 days' written notice identifying the specific provisions of the same title of the Civil Code that the consumer alleges have been or are being violated. If a cure is possible and, within the 30 days, the business actually cures the noticed violation and gives the consumer an express written statement that the violations have been cured and that no further violations shall occur, no action for individual or class-wide statutory damages may be initiated. Implementing and maintaining reasonable security procedures and practices after a breach does not constitute a cure for that breach. No notice is required before an individual consumer starts an action solely for actual pecuniary damages.
The cause of action applies only to violations of the kind described above and is not based on violations of any other section of that title. Whether a particular situation meets these conditions depends on its facts. State law differs from state to state, and this is California's rule.