CRPA Member Wins $5,000 In CCW Data Breach Case
A Tehama County CRPA member whose personal information was leaked to the public in the June 2022 CCW data leak recently won a $5,000 judgment against the DOJ in small claims court. The plaintiff in the case alleged that the DOJ violated his rights under California’s Information Practices Act (Civil Code 1798 et. Seq.) and claimed that the violation caused him emotional distress. The court agreed.
The court found that there was no question that the threat of identity theft and fraud that the DOJ notified the plaintiff could result from the breach would cause the plaintiff anxiety and emotional distress. The court noted that recovering damages for emotional distress (also known as “general” damages) did not require the plaintiff to prove the existence of measurable specific damages (also known as “special” damages).
This confirms CRPA’s belief from the beginning that the DOJ is liable for the emotional distress that the leak caused its members. Unfortunately, California law does not recognize the validity of emotional distress damages in a class action context, which is why no class action lawsuits arising from the leak were filed against DOJ after the leak.
The plaintiff in this lawsuit was able to bring this lawsuit because he timely submitted a pre-litigation claim under the Government Claims Act (“GCA”) to the DOJ. In California, a plaintiff cannot file a lawsuit in any court unless the plaintiff submits a claim to the government under the GCA no later than six months from the date of the incident that the plaintiff is suing over. Once the DOJ receives the claim, it has 45 days to respond to it and do one of three things. First, it can decide to settle the claim. That is rare. Second, it can issue a rejection notice. Third, it can do nothing.
If the DOJ issues a rejection notice, the plaintiff has six months to sue from the date the notice is sent to the plaintiff. If the government does not send a notice within 45 days to the plaintiff, then the plaintiff has two years from the date of the incident to sue.
In this situation, people whose data was leaked on June 27, 2022, had until December 27, 2022, to submit a claim. Assuming that a claim was submitted on the very latest day to timely submit a GCA claim (December 27, 2023), the very latest deadline for DOJ to reject would be February 10, 2023, and the very latest day to file a lawsuit after that would be August 10, 2023. Thus, the deadline to bring a suit like this one has passed for everyone who submitted a claim and received a rejection notice. However, there may be individuals who submitted a claim and never received a rejection notice. If that is your situation, the deadline to file a suit is roughly June 27, 2024. DOJ has stated that nearly 500 people filed GCA claims arising from the CCW data leak.
California law does recognize a process for claimants who failed to timely file to ask for permission to bring an untimely lawsuit. More on filing untimely claims against the state can be found on the CRPA Resource page under the Small Claims section or by clicking here https://crpa.org/ca-doj-dox-gate/ . There is no guarantee this will work, however, but individuals who want to try are encouraged to seek legal assistance.