Answer: B
While a consumer is not permitted to sue a business for its noncompliance with its obligations under the CCPA, such as disclosing or deleting personal information, Section 1798.81.5 requires businesses to take certain steps to protect the security of personal information they have on file. A consumer may initiate a private civil action to recover damages if the consumer’s unencrypted and unredacted personal information is breached due to an organization’s noncompliance with CCPA.
This type of private right of action may be pursued even if the consumer did not suffer actual damages from the organization’s violations of CCPA. Consumers may recover between $100 and $750 per incident or actual damages under this type of private right of action.
