California Consumer Privacy Act of 2018: consumer remedies.

(1) Existing law, the California Consumer Privacy Act of 2018, beginning on January 1, 2020, grants a consumer various rights with regard to personal information relating to that consumer that is held by a business, including the right to know what personal information is collected by a business and to have information held by that business deleted, as specified. The act specifically authorizes a consumer whose nonencrypted or nonredacted personal information, as defined, is subject to unauthorized access and exfiltration, theft, or disclosure as a result of the business's failure to maintain reasonable security procedures to institute a civil action for various damages. This bill would expand a consumer's rights to bring a civil action for damages to apply to other violations under the act. (2) Under existing law, a business or third party may seek the opinion of the Attorney General for guidance on how to comply with the act. This bill would instead specify that the Attorney General may publish materials that provide businesses and others with general guidance on how to comply with the act. (3) Under existing law, a business, service provider, or other person that violates the act is subject to an injunction and is liable for a civil penalty for each violation, which is assessed and recovered in a civil action by the Attorney General. Existing law specifies that a business is in violation of the act if it fails to cure an alleged violation within 30 days after being notified of alleged noncompliance. This bill would delete the 30-day period in which to cure after receiving notice of an alleged violation. The bill would also make related and conforming changes to those provisions.