The CCPA Lawsuit That Blindsided an LA Plumbing Contractor
A 45-employee plumbing contractor in the San Fernando Valley thought CCPA was for tech companies. Then their payroll provider was breached, exposing unencrypted employee SSNs, bank account numbers, and home addresses for 120 current and former employees.
Under CCPA's private right of action (Cal. Civ. Code § 1798.150), each affected individual could claim $100-$750 in statutory damages — no proof of actual harm required. A plaintiff's attorney filed a class action within three weeks of the breach notification.
The contractor's defense costs alone exceeded $85,000. The settlement: $67,500 plus injunctive relief requiring specific security controls. With cyber insurance, the entire cost — defense, settlement, and security improvements — would have been covered.
Does CCPA Apply to Your LA Construction Business?
CCPA/CPRA applies if your business meets ANY ONE of these thresholds:
- Annual gross revenue exceeding $25 million — Most mid-size LA GCs qualify
- Annually buys, sells, or shares personal information of 100,000+ consumers — "Consumers" includes employees and B2B contacts
- Derives 50%+ of annual revenue from selling consumers' personal information — Rarely applies to contractors
If you meet threshold #1 (the most common for LA contractors), you're subject to CCPA regardless of what type of data you handle or how many employees you have.
What Data Triggers CCPA for Contractors?
LA contractors hold more CCPA-protected data than most realize:
Employee Data
- Social Security numbers, driver's licenses, bank accounts
- Health insurance information, drug test results
- I-9 immigration documents
- Workers' comp claim records
- Payroll tax records
Subcontractor & Vendor Data
- Individual subcontractor SSNs and EINs
- Insurance certificate personal details
- Licensing and bonding personal information
- Payment and banking details
Client Data
- Residential client personal information
- Property owner financial data
- HOA board member contact information
CCPA Private Right of Action: The Risk for LA Contractors
Unlike most state privacy laws, CCPA allows individuals to sue directly when their unencrypted personal information is breached due to a business's failure to implement "reasonable security measures."
Key elements:
- No proof of actual harm required — statutory damages of $100-$750 per consumer per incident
- Class action eligible — plaintiff's attorneys actively seek these cases
- Reasonable security standard — California AG has pointed to the CIS Critical Security Controls as the benchmark
- Cure provision — businesses get 30 days to cure before statutory damages apply, but this only applies to the security deficiency, not the breach itself
For an LA contractor with 200 employees, a breach of unencrypted employee data creates potential statutory damages exposure of $20,000-$150,000 — before defense costs.
How Cyber Insurance Covers CCPA Exposure
A comprehensive cyber liability policy covers the full spectrum of CCPA/CPRA exposure:
Regulatory Coverage
- Defense costs before the California AG and CPPA
- Regulatory fines and penalties where insurable (up to $7,500 per intentional violation)
- Compliance consulting and remediation
Private Right of Action Coverage
- Class action defense costs
- Settlement payments
- Judgments and damages
Breach Response Coverage
- Forensic investigation to determine breach scope
- CCPA-compliant notification (within 72 hours)
- Credit monitoring services
- Public relations and crisis management
CCPA Compliance Checklist for LA Contractors
- Privacy policy — Publish a CCPA-compliant privacy policy covering employee and consumer data
- Data inventory — Document what personal information you collect, where it's stored, and who has access
- Security measures — Implement "reasonable security" aligned with CIS Controls or NIST CSF
- Consumer rights processes — Establish procedures for data access, deletion, and opt-out requests
- Vendor management — Ensure subcontractors and vendors who handle your data have adequate security
- Incident response plan — Document breach detection, investigation, and notification procedures
- Training — Annual CCPA awareness training for employees who handle personal information
- Cyber insurance — Obtain coverage that specifically addresses CCPA regulatory and private right of action exposure
Common Questions
My revenue is under $25M. Am I exempt from CCPA?
If your revenue is under $25M AND you don't process data on 100,000+ consumers AND you don't derive 50%+ of revenue from selling data, you're currently exempt from CCPA. However, you still face breach liability under California's general negligence framework and SB 1386 notification requirements. Cyber insurance is still strongly recommended.
Does cyber insurance cover CCPA fines?
Most cyber policies cover CCPA fines "where insurable by law." California generally allows insurance coverage of regulatory penalties. Your policy should specifically name CCPA/CPRA coverage. Check with your broker.
What's the difference between CCPA and CPRA?
CPRA (effective January 2023) expanded CCPA with additional consumer rights, created the California Privacy Protection Agency for enforcement, and introduced the concept of "sensitive personal information" with additional protections. For contractors, the practical impact is stricter enforcement and additional compliance obligations.