Salesforce.com hit with early privacy act class action

Salesforce.com Inc. and a children's clothing store have been hit with a proposed class action that will be among the first to test California's landmark Consumer Privacy Act.

The plaintiffs alleged Hanna Andersson and its online payment services provider Salesforce failed to properly safeguard customers' personally identifiable information, according to the complaint filed in federal court in Oakland on Monday.

Michael Berry of the Arnold Law Firm represents named plaintiff Bernadette Barnes of Sacramento.

Hanna Andersson announced the breach in which hackers stole customer names, payment information and addresses, among other data, on Jan. 15. It notified state attorneys general nearly 9,000 Washington residents and more than 10,000 California residents were affected.

Law enforcement, not Salesforce, initially notified Hanna Andersson of the breach, according to the complaint. The lawsuit argues Hanna Andersson purposefully covered up the breach. But because it occurred from September to November 2019, it remains unclear whether the defendants can be held liable for damages under the California Consumer Privacy Act, which went into effect his January.

Although the lawsuit does not specify damages, California residents can recover $100 to $750 per data breach under the privacy law. This could mean millions in damages for huge data collectors like Salesforce.

The plaintiffs also alleged violations of California's Unfair Competition Law and Consumer Privacy Act. Barnes v. Salesforce.com, Inc., 20-CV00812 (N.D. Cal., filed Feb. 3, 2020).

-- Winston Cho