Consumers are permitted to bring suit under the CCPA if they can prove the following five elements:

1. A business incurred a data breach;

2. The data breach involved a sensitive category of information identified in California Civil Code Section 1798.81.5;

3. The business had a legal duty to protect the personal information from breach;

4. The business failed to implement reasonable security procedures and practices; and

5. The business’s failure resulted in (i.e., caused) the data breach.

The definition of personal information used in California Civil Code Section 1798.81.5 is narrower than the definition of personal information used within the rest of the CCPA. Specifically, while the CCPA’s general definition of “personal information” contains 26 examples of types of data fields, only a subset of data combinations can form the basis of a consumer lawsuit.