The California Consumer Privacy Act authorizes only the state attorney general to enforce the statute, but a pending statutory amendment and a recent California Supreme Court ruling could end up expanding enforcement power to district attorneys.
With the passing of the July 1 enforcement date of the California Consumer Privacy Act (CCPA), attention turns to enforcement issues. The CCPA in its current form only authorizes the California attorney general to enforce the statute.[1] District and city attorneys therefore cannot bring enforcement actions for violations of the CCPA. However, there is a pending amendment to the CCPA that would propose to expand enforcement authority under the CCPA to include district attorneys. Separately, on June 25, the California Supreme Court rendered a long-awaited decision in Abbott Laboratories v. Superior Court (Abbott Labs),[2] in which it granted district attorneys statewide enforcement authority under the California Unfair Competition Law (UCL),[3] another consumer protection statute. This LawFlash discusses the potential impact of Abbott Labs on district attorneys’ authority to bring CCPA enforcement actions statewide should the proposed amendment be adopted.
In Abbott Laboratories v. Superior Court, the Orange County District Attorney brought an action under the UCL against several pharmaceutical companies, including Abbott Laboratories (Abbott), alleging that they intentionally delayed the sale of a pharmaceutical drug to maximize profits.[4] Abbott filed a motion to strike certain portions of the complaint, arguing that the Orange County District Authority is not legally authorized to prosecute violations of the UCL allegedly occurring outside Orange County. The Superior Court denied Abbott’s motion, and Abbott appealed.[5]
The Court of Appeal reversed the superior court order, holding that permitting a district attorney to enforce the UCL for violations occurring outside his or her county would encroach upon the powers of the attorney general.[6] The Orange County District Attorney appealed to the California Supreme Court, which granted certiorari to address the narrow question of whether the UCL “preclude[s] a district attorney, in a properly pleaded case, from including allegations of violations occurring outside as well as within the borders of his or her county.”[7]
The California Supreme Court reversed the Court of Appeal and held that district attorneys may prosecute UCL actions beyond their counties. Pointing to its “broad equitable authority” to fashion relief under the UCL – while acknowledging that the statute’s legislative intent was inconclusive – the state Supreme Court ultimately held that the legislative record did reveal a “clear trajectory” of “greater and overlapping public enforcement at all levels of government.”[8] Central to its holding was the language of the UCL providing that “[a]ctions for relief pursuant to [the UCL] shall be prosecuted exclusively in a court of competent jurisdiction by the Attorney General or any district attorney.”[9] Furthermore, the state Supreme Court recognized that despite some of the concerns associated with statewide enforcement by district attorneys – namely, that they may be “incentivize[d] . . . [to] act[] in their respective county’s financial self-interest” at the expense of “full redress for violations in other counties,” such concerns are not ultimately outweighed by the benefit of additional enforcement of the statute.[10]
Though Abbott Labs is limited to actions brought under the UCL, it might provide insight into the question of the enforcement of the CCPA if it was amended and potentially other California consumer protection statutes. Additionally, while Abbott Labs focused on the statutory language of the UCL, certain aspects of the holding – in particular, the broader role for district attorneys in enforcing the statute – could be extended to other consumer protection statutes, including to an amended CCPA. That could in turn justify statewide enforcement by district attorneys if CCPA is amended.
As it stands, the CCPA does not empower district attorneys to bring enforcement actions for violations of the statute at all. Rather, 1798.155(b) provides that "[t]he civil penalties provided for in this section shall be exclusively assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General” (emphasis added).[11] This language forecloses district attorneys from prosecuting violations under the CCPA as a standalone statute, at least for the time being. However, there is a pending amendment before the California state legislature– introduced in February 2019 – which expressly confers upon district attorneys the authority to enforce the statute.[12] If the statute is amended, either by the legislature or by a ballot initiative, a broad reading of Abbott Labs creates the risk that district attorneys will be able to enforce the CCPA statewide.
Abbott Labs creates the potential – should the CCPA be amended – for district attorneys to attempt to enforce violations of the CCPA on a statewide basis. In order to minimize risk from heightened enforcement, companies are advised to stay abreast of current CCPA developments and, in particular, amendment efforts. Morgan Lewis is ready to assist companies in responding to both California attorney general and district attorney enforcement actions related to cybersecurity and privacy matters as they may arise.
The Morgan Lewis privacy team is providing practical privacy advice to more than 200 businesses on compliance with the CCPA and proposed regulations. If you have any questions or would like more information, please contact any of the following Morgan Lewis lawyers:
San Francisco
Reece Hirsch
Carla Oakley
Michelle Park Chiu
Kevin Benedicto
Nicholas "Cole" Pfeiffer
Los Angeles
Joseph Duffy
Philadelphia
Gregory Parks
Ezra Church
Kristin Hadgis
Julian Williams
New York
Martin Hirschprung
Washington, DC
Ronald Del Sesto
Dr. Axel Spies
[1] See Cal. Civ. Code § 1798.185(c).
[2] Abbott Labs. v. Superior Court, No. S249895, 2020 WL 3525181 (June 25, 2020).
[3] Bus. & Prof. Code § 17200 et seq.
[4] Abbott Labs., 2020 WL 3525181 at *1.
[5] Id. at *2.
[6] See id.
[7] Id. at *1.
[8] Id. at *6.
[9] Id. at *3 (citing Bus. & Prof. Code § 17204) (emphasis added).
[10] Id. at *9.
[11] Cal. Civ. Code § 1798.155(b).
[12] Cal. Assemb. B. 1760, Reg. Sess. (Cal. 2019).