Class Action Settlement … for CCPA?

The California Consumer Privacy Act (“CCPA”) went into effect on January 1, 2020 with no private right of action – the only person who could bring suit was a government enforcement agency. In other words, the only risk for non-compliance was a 30-day cure notice and potential enforcement action by an underfunded Attorney General’s office. That is until you have a data breach…and then all bets are off as the data breach will give rise to a private right of action for CCPA statutory penalties. Over 100 class actions referencing the CCPA have been filed to date, though very few have attained a court approved settlement or court approved penalty assessment. The Northern District of California is about to change that. This month, the trial court granted a granted preliminary approval in a data breach class action involving 4.1 million potential class members, in Atkinson, et al v. Minted, Inc., Case No. 3:20-cv-03869 (N.D. Cal.). The settlement called for a five million dollar settlement fund but not the $750.00 per violation (which would have resulted in over $3,000,000,000 penalty) is based on a group of hackers that breached San Francisco-based Minted, Inc. (“Minted”) (as well as eleven other companies) and then attempted to sell that personal information (“PI”). In total, 4.1 million consumers were purportedly impacted by the breach.