The Retail Equation (formerly known as The Return Exchange) was hit in early-2020 with a class action earlier this year.  Sephora is also a defendant. While it is not clear that the CCPA allows relief for the allegations made by the plaintiffs, that has not stopped the plaintiffs from suing not just these two companies, but other retailers as well.  The plaintiffs allege that Sephora improperly shared consumer information with TRE without informing consumers or seeking their consent.  The plaintiffs also claim that TRE used information consumer from Sephora to create risk scores that allegedly were “used as a pretext to advise Sephora that attempted product returns and exchanges are fraudulent and abusive.”

With an amended complaint, there are new defendants in the case.  Twelve new retailers have been named in the matter based on their alleged use of TRE’s services to identify fraudulent returns. The plaintiffs assert claims against the retailers for invasion of privacy, violations of California’s unfair competition law, unjust enrichment, and, most notably, violations of the CCPA.

As noted by a Hunton blog,

it is questionable whether the CCPA, which provides for statutory damages of no less than $100 and up to $750 per violation, even applies. The CCPA’s private right of action is limited to situations where personal information is “subject to unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices” (Cal. Civ. Code § 1798.150). The plaintiffs’ claims, however, concern the voluntary transfer of data to a third-party service provider. Contrary to a data breach, a voluntary transfer arguably does not involve any alleged “violation of the duty to implement and maintain reasonable security procedures and practices.” We note this same theory has been asserted against Zoom based on its alleged sharing of data with Facebook. Zoom’s response to the complaint in that action, In Re: Zoom Video Communications, Inc. Privacy Litigation, N.D. Cal. Case No. 5:20-cv-02155-LHK, is due on September 14, 2020.