AB 1546: California Consumer Privacy Act of 2018: statute of limitations.

The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to request that a business delete personal information about the consumer that the business has collected from the consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA. The CCPA establishes the California Privacy Protection Agency with full administrative power, authority, and jurisdiction to implement and enforce the CCPA. The CCPA subjects a violator of its provisions to a certain administrative fine pursuant to an administrative action brought by the agency, as prescribed. The CCPA prohibits an administrative action from being commenced more than 5 years after the date on which a violation occurred. The CCPA also subjects a violator of its provisions to a civil penalty, as specified, to be assessed and recovered in a civil action brought by the Attorney General. Existing law generally requires an action upon a statute for a forfeiture or penalty to the people of the state to be commenced within one year.

This bill would require an action by the Attorney General to enforce the CCPA to be commenced within 5 years after the cause of action accrued.