Last year, California passed the California Consumer Privacy Act, which creates a private right of action for consumers whose personal information is subject to unauthorized access. The law goes into effect in January. A similar law is pending in the Massachusetts legislature.

• The California law applies to companies with an annual revenue of at least $25 million that either (1) do business in California, (2) receive personal information on at least 50,000 California residents, or (3) earn half of their revenue from selling the data of California residents.
• A similar bill, titled “An Act Relative to Consumer Data Privacy,” was introduced in the Massachusetts legislature earlier this year and allows consumers to sue when their personal information is improperly collected or distributed.
• The Massachusetts bill applies to for-profit businesses that collect personal information from Massachusetts consumers and have either (1) annual gross revenues of over $10 million or (2) derive more than 50% of annual revenues from third-party disclosures of consumer information.
• Under the Massachusetts bill, any violation constitutes an injury-in-fact, such that the consumer need not suffer a loss of money or property to bring an action. Additionally, the named plaintiff in any successful class action can recover up to $750 per consumer per incident (or actual damages, if greater), plus reasonable attorney fees and costs.
• California and Massachusetts join the recent trend of state legislatures increasing government regulation of consumer data. These initiatives could lead to numerous class action lawsuits against businesses that handle or store consumers’ personal information.

Read more here and here.