Industry Insight: The CCPA’s Elusive “Reasonable Security” Safe Harbor

The CCPA defines a data breach as the “unauthorized access and exfiltration, theft, or disclosure” of “nonencrypted or nonredacted personal information” resulting from “the business’ violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information.” (Emphasis added).