Breach of Privacy

Breach of privacy is the unauthorized access, use, or disclosure of personal or sensitive information, or an unwanted intrusion into private life, that violates a person’s right to privacy. A breach of privacy can arise from digital data misuse, such as a hacked customer database, or from traditional violations, such as a hidden camera or a secretly recorded phone call. California protects privacy through Article I, section 1 of the state constitution, four common law privacy torts, and statutes including the California Consumer Privacy Act.

What is the Breach of Privacy?

A breach of privacy is the violation of a person’s private information or personal space without consent or legal justification. A breach of privacy happens in digital settings, where stored records are exposed, and in physical settings, where a person is watched, recorded, or publicized against their will. The right behind every breach of privacy claim in California comes from a 1972 voter initiative that added privacy to the inalienable rights listed in the state constitution. That constitutional right binds private businesses and individuals as well as government agencies.

The data breach meaning is narrower than a privacy breach. A breach of data privacy occurs when unauthorized people access or acquire stored personal information. An integrity breach, a term from information security, occurs when that information is altered or destroyed without authorization, even if nobody copies it. Federal information security standards published by NIST define integrity as protection against improper modification or destruction of information. A privacy breach can involve any of these events, along with conduct that never touches a computer.

What Qualifies as Misuse of Personal Information?

Misuse of personal information is collecting, sharing, or using personal data without the person’s consent or a valid legal basis. Misuse of personal information includes selling data after a consumer opts out, sharing medical details with an employer, and keeping sensitive records on an unsecured server. The improper handling of sensitive data qualifies as misuse even when no outsider ever sees it, because the harm lies in the loss of control over the information. A personal data breach, the term European data protection law uses, describes a security failure that exposes personal data. Unauthorized processing of personal information is broader, covering data a company collects or uses without a lawful reason, even when the company’s systems were never hacked.

Does Breach of Privacy Always Involve Personal Data?

No, a breach of privacy does not always involve personal data, because California law also protects private places, conversations, and a person’s identity. A breach of privacy occurs when someone peers through a bedroom window, plants a hidden camera in a rental home, or records a confidential conversation without consent. The California Invasion of Privacy Act makes California an all party consent state for recording confidential communications, and Penal Code section 637.2 allows a civil award of $5,000 per violation or three times actual damages. Commercial use of a person’s photo in an advertisement counts as a privacy violation, even though no database was involved.

Is Breach of Privacy a Civil or Criminal Issue?

Breach of privacy is both a civil and a criminal issue, depending on the conduct involved. Breach of privacy usually leads to a civil lawsuit for money damages under the common law torts, the state constitution, or statutes like the California Consumer Privacy Act. Some privacy violations also count as a criminal offense under California law, including eavesdropping on confidential communications, accessing a computer or phone without permission under Penal Code section 502, and distributing intimate images without consent. Illegal recording under Penal Code section 632 is punishable by a fine of up to $2,500 per violation, up to one year in county jail, or a state prison term, and a repeat offender faces fines of up to $10,000 per violation. The same act can support both a prosecution and a separate civil case.

What are the Different Types of Breach of Privacy?

California recognizes four common law types of breach of privacy, which are intrusion, public disclosure, false light, and appropriation, plus constitutional and statutory claims. The four types of breach of privacy come from the Restatement of Torts framework that California courts adopted, and each targets a different kind of harm.

1. Intrusion upon seclusion (intrusion) occurs when someone intentionally intrudes into a private place, conversation, or matter in a way a reasonable person would find highly offensive, as the California Supreme Court described in Shulman v. Group W Productions (1998).
2. Public disclosure of private facts (disclosure) occurs when someone publicizes private information that would offend a reasonable person and is not a matter of legitimate public concern.
3. False light (false light) occurs when someone publicizes information that places a person in a false and highly offensive light, such as captioning a stranger’s photo with an unrelated crime story.
4. Appropriation of name or likeness (appropriation) occurs when someone uses another person’s name, photo, or voice for commercial gain without consent, which Civil Code section 3344 backs with a minimum $750 award.

Each type of privacy violation protects a different interest. Intrusion punishes the act of prying, disclosure punishes spreading true but private facts, false light punishes misleading publicity, and appropriation punishes taking the commercial value of a person’s identity.

What is the Difference Between Data Breach and Privacy Breach?

A data breach is unauthorized access to or acquisition of digital data, while a privacy breach is any violation of a person’s privacy rights, digital or not. A data breach centers on computer systems and the records stored inside them. California’s notification statute, Civil Code section 1798.82, uses the term to describe unauthorized acquisition of computerized personal information that compromises its security, confidentiality, or integrity. A data breach can involve no personal information at all, such as the theft of trade secrets or source code. A privacy breach covers everything a data breach covers when personal information is exposed, plus non-digital violations like stalking, secret recordings, and the publication of private medical facts.

Is Unauthorized Disclosure Considered a Privacy Breach?

Yes, unauthorized disclosure is considered a privacy breach when someone shares private facts about a person without consent and the disclosure would offend a reasonable person. Unauthorized disclosure must involve facts that were truly private, so repeating information already in court records or on a public social media profile rarely qualifies. The tort of public disclosure of private facts requires publicity, meaning the facts reached the public or a large enough group that they were likely to become public knowledge. A coworker who posts a colleague’s HIV diagnosis in a company group chat can face liability, while a news report on a public official’s criminal case is usually protected as newsworthy.

What are the Causes of Privacy Breaches?

Privacy breaches are caused by cyberattacks, human error, weak security systems, insider misuse, and failures at third party vendors. Privacy breaches rarely come from a single failure. Verizon’s 2026 Data Breach Investigations Report, which analyzed more than 22,000 confirmed breaches, found that the human element played a role in 62 percent of them.

1. Cyberattacks expose data when criminals exploit software flaws, steal login credentials, or deploy ransomware that copies files before locking them.
2. Human error exposes data when an employee emails records to the wrong person, misconfigures cloud storage, or clicks a phishing link.
3. Weak security systems expose data when a business skips encryption, multifactor authentication, or timely software patches.
4. Insider misuse exposes data when an employee with legitimate access snoops through records or sells them.
5. Vendor failures expose data when a payroll processor, billing company, or software provider holding customer records is breached, and Verizon found a third party involved in 48 percent of breaches.

Poor data management multiplies each of these risks. A business that keeps old customer records it no longer needs, or stores sensitive files in shared folders open to every employee, gives attackers and careless insiders far more to expose.

How do Cyberattacks Lead to Breaches of Privacy?

Cyberattacks lead to breaches of privacy by giving criminals unauthorized access to systems that store personal information, which they then copy, sell, or hold for ransom. Cyberattacks most often begin by exploiting unpatched software, which Verizon’s 2026 report identified as the leading way attackers got in, at 31 percent of breaches. The speed of modern cyberattacks makes patching delays dangerous, and Tenable data in the same report showed the median time to patch known exploited flaws rose from 32 days to 43 days. Ransomware appeared in 48 percent of breaches, and ransomware groups routinely steal data before encrypting it so they can threaten to publish it. Stolen records then surface on criminal marketplaces, where buyers use them for identity theft, account takeovers, and targeted scams.

Can Human Error Cause a Privacy Breach?

Yes, human error can cause a privacy breach, and mistakes by employees and users contribute to a majority of breaches. Human error includes sending a spreadsheet of customer Social Security numbers to the wrong recipient, leaving a cloud database open to the internet, and entering a password on a fake login page. The legal significance of human error is that a business can still be liable even though no hacker broke in. A business that fails to train staff or restrict access may have failed to maintain reasonable security, which is the standard behind the California Consumer Privacy Act’s data breach lawsuit provision.

What are Examples of Breach of Privacy?

Examples of breach of privacy include leaked customer data, unauthorized surveillance, secret recordings, medical record snooping, and sharing personal details publicly. Breach of privacy examples span both corporate data failures and personal misconduct between individuals.

1. Leaked customer data violates privacy expectations when a retailer’s breach exposes names, card numbers, and addresses that customers trusted the retailer to protect.
2. Unauthorized surveillance violates privacy expectations when a landlord installs a hidden camera in a tenant’s bathroom or a partner tracks a phone’s location without permission.
3. Secret recordings violate privacy expectations when someone records a confidential phone call without the consent of everyone on the line.
4. Medical record snooping violates privacy expectations when a hospital employee opens the chart of a neighbor or celebrity with no treatment reason.
5. Doxxing violates privacy expectations when someone posts a person’s home address, phone number, and daily routine online to invite harassment.
6. Unauthorized advertising violates privacy expectations when a business uses a customer’s photo in marketing without signed permission.

Each example involves information or activity the person reasonably expected to stay private. The context of each example, including who accessed the information and why, determines which claim applies.

Are Workplace Data Leaks Considered Privacy Breaches?

Yes, workplace data leaks are considered privacy breaches when employee or customer information is exposed through the employer’s failure to protect it or a worker’s misuse of it. Workplace data leaks often involve payroll records, Social Security numbers, background checks, and medical leave documentation. The employer’s liability for a workplace data leak depends on whether it maintained reasonable security procedures, which California Civil Code section 1798.81.5 requires of businesses that own, license, or maintain personal information. A worker who leaks a coworker’s medical information can face individual liability for public disclosure of private facts.

Is Accessing Someone’s Phone without Permission a Breach of Privacy?

Yes, accessing someone’s phone without permission is a breach of privacy, and reading another person’s messages, photos, or location history can support both an intrusion claim and criminal charges. Accessing a phone counts as intrusion because the California Supreme Court held in Shulman v. Group W Productions (1998) that the tort reaches unwanted access to data about a person as well as physical entry. Accessing someone’s phone without permission falls within Penal Code section 502, which prohibits knowingly accessing a computer, device, or data without permission. The owner of a device who suffers damage or loss from that access can bring a civil action under section 502(e) for compensatory damages, including the cost of checking whether data was altered or deleted. The court may award reasonable attorney fees, and the owner has three years from the access or from discovering the damage to file. Marriage or a dating relationship does not create permission, so a spouse who installs tracking software on a partner’s phone can face the same liability as a stranger.

What Legal Obligations do Businesses have to Prevent Breaches?

Businesses must implement reasonable security measures, comply with data protection laws, and notify affected people promptly when a breach occurs. Businesses that own, license, or maintain personal information about California residents must implement and maintain reasonable security procedures appropriate to the nature of that information under Civil Code section 1798.81.5. The same statute requires a business that shares personal information with an outside vendor to require reasonable security from that vendor by contract. The California Consumer Privacy Act adds duties for covered businesses, including honoring requests to delete data and to opt out of its sale.

Notification deadlines tightened in 2026. Senate Bill 446, signed on October 3, 2025, and effective January 1, 2026, requires businesses to notify affected California residents within 30 calendar days of discovering a data breach. A breach affecting more than 500 California residents also requires a sample notice to the Attorney General within 15 calendar days of notifying consumers. The statute allows delays only for legitimate law enforcement needs or to determine the scope of the breach and restore the integrity of the system.

Federal laws layer additional obligations on certain industries. Health care providers answer to HIPAA, and financial institutions answer to the Gramm Leach Bliley Act, each with its own safeguarding and notice rules.

What Happens if Customer Data is Exposed?

Customer data exposure triggers notification duties for the business and can lead to consumer lawsuits, class actions, and regulatory fines. Customer data exposure caused by a failure to maintain reasonable security lets consumers sue under Civil Code section 1798.150 when their nonencrypted and nonredacted personal information was accessed and taken. The statutory damages under section 1798.150 range from $107 to $799 per consumer per incident, or actual damages if greater, after the California Privacy Protection Agency adjusted the original $100 to $750 range on January 1, 2025. A consumer seeking statutory damages must first give the business 30 days’ written notice and a chance to cure the violation. Regulators can also impose administrative fines of up to $2,663 per violation, or $7,988 for intentional violations and those involving minors’ data.

What Must be Proven in a Breach of Privacy Case?

A breach of privacy case requires proof of a protected privacy interest, a reasonable expectation of privacy, a serious or highly offensive invasion, and resulting harm. A breach of privacy claim under the California Constitution follows the three threshold elements from Hill v. National Collegiate Athletic Association (1994), and the common law torts add their own requirements.

1. Protected privacy interest means the information or activity falls within informational privacy, such as medical records, or autonomy privacy, such as personal decisions made without observation.
2. Reasonable expectation of privacy means the person expected privacy under the circumstances and society would accept that expectation as reasonable.
3. Serious invasion means the intrusion or disclosure was serious enough, or offensive enough to a reasonable person, to amount to an egregious breach of social norms.
4. Unauthorized access or disclosure means the defendant obtained, used, or shared the information without consent or legal authority.
5. Harm means the plaintiff suffered financial loss, emotional distress, reputational damage, or statutory injury.

Proof depends on the type of claim. A data breach lawsuit under the California Consumer Privacy Act focuses on whether the business failed to maintain reasonable security, while a constitutional claim lets the defendant argue that the invasion was justified by countervailing interests.

What Evidence is Used in Privacy Breach Claims?

Privacy breach claims rely on records showing what information was exposed, how it was exposed, and what harm followed. Privacy breach evidence usually falls into seven categories.

1. Breach notification letters establish that the business itself acknowledged the exposure and identify the data involved.
2. Screenshots and copies of posts, messages, or published material preserve the disclosure before it is deleted.
3. Access logs and audit trails show who opened a file or account, when, and from where.
4. Recordings and device data document surveillance, tracking, or unauthorized phone access.
5. Financial records show fraudulent charges, credit monitoring costs, and lost income tied to the breach.
6. Medical and counseling records document anxiety, sleep loss, and other emotional distress.
7. Cybersecurity witness testimony explains whether the defendant’s safeguards met industry standards.

The strength of privacy breach evidence often depends on how quickly it is preserved. Social media posts disappear and server logs roll over, so early preservation letters matter. Evidence must also be gathered lawfully, because Penal Code section 632 bars courts from admitting a confidential conversation recorded without everyone’s consent, except in a case over the recording itself.

What Damages can be Claimed in a Privacy Breach Case?

Privacy breach damages include financial loss, emotional distress, reputational harm, statutory damages, and in some cases profits, punitive damages, and attorney fees. Privacy breach damages vary with the claim.

1. Financial loss covers fraudulent charges, identity theft recovery costs, credit monitoring, and lost wages.
2. Emotional distress covers anxiety, humiliation, and fear caused by the exposure or surveillance.
3. Reputational harm covers damage to personal and professional standing after private facts spread.
4. Statutory damages cover fixed awards set by law, including $107 to $799 per consumer per incident under the California Consumer Privacy Act and $5,000 per violation under the Invasion of Privacy Act.
5. Disgorged profits cover money a defendant earned by using a person’s name or likeness under Civil Code section 3344.
6. Attorney fees cover legal costs where a statute shifts them, as section 3344 does for the prevailing party.

Courts evaluate impact by looking at how sensitive the information was, how widely it spread, and how long the harm lasted. Section 1798.150 directs courts setting statutory damages to weigh the seriousness of the misconduct, the number of violations, its persistence, the defendant’s willfulness, and the defendant’s financial condition.

Are Punitive Damages Available for Serious Breaches?

Yes, punitive damages are available for serious breaches when the plaintiff proves by clear and convincing evidence that the defendant acted with oppression, fraud, or malice. Punitive damages in California fall under Civil Code section 3294 and apply to willful misconduct, not ordinary carelessness. A plaintiff can seek punitive damages against someone who secretly filmed a tenant or deliberately sold customer data, because those acts show conscious disregard for the victim’s rights. Punitive awards serve to punish the wrongdoer and deter similar conduct by others, which is why courts consider the defendant’s wealth when setting the amount. A corporate employer faces punitive damages for an employee’s misconduct only when an officer, director, or managing agent knew of the employee’s unfitness in advance, authorized or ratified the conduct, or personally acted with malice.

What Defenses Exist Against Breach of Privacy Claims?

Defenses against breach of privacy claims include consent, newsworthiness, legal authority, lack of a reasonable expectation of privacy, lack of harm, and expired deadlines. Breach of privacy defenses reduce or eliminate liability by attacking one element of the claim or by justifying the conduct.

1. Consent defeats a claim when the plaintiff agreed to the collection, recording, or use, though consent must cover the specific conduct at issue.
2. Newsworthiness defeats a public disclosure claim when the information concerns a matter of legitimate public interest, which the California Supreme Court treated as a complete bar in Shulman v. Group W Productions (1998).
3. Legal authority protects conduct carried out under a warrant, subpoena, or court order, and statements made in official proceedings fall under the litigation privilege in Civil Code section 47.
4. No reasonable expectation defeats a claim when the information was already public or the activity happened in plain view.
5. Countervailing interests can justify an invasion under the California Constitution when the defendant’s conduct substantially furthers a legitimate interest.
6. Reasonable security defeats a California Consumer Privacy Act data breach claim when the business shows its safeguards met the required standard.
7. Lack of standing defeats a federal court claim when the plaintiff cannot show a concrete injury, because TransUnion LLC v. Ramirez (2021) held that a statutory violation alone is not enough and that a risk of future harm cannot support damages. The same decision recognized disclosure of private information and intrusion upon seclusion as concrete harms, which helps plaintiffs whose data actually reached third parties.
8. Statute of limitations defeats a claim filed too late, generally two years for intrusion, disclosure, and appropriation claims, one year for false light and Invasion of Privacy Act claims, and three years for civil claims under Penal Code section 502.

The strongest privacy defense depends on the claim type. Consent and reasonable security dominate data breach cases, while newsworthiness and prior publicity dominate disclosure cases involving the media.

How can Individuals Prevent Breaches of Privacy?

You can reduce the risk of a breach of privacy by locking down your accounts, limiting what you share, and using the legal rights California gives you over your data. Turn on multifactor authentication for email, banking, and social media accounts, and use a password manager so every account has a unique password. Install software updates on your phone and computer promptly, since attackers target known flaws. Freeze your credit with Equifax, Experian, and TransUnion, which is free and blocks new accounts opened in your name. Review which apps can see your location, contacts, and photos, and remove permissions they do not need. Send deletion and opt out requests to businesses under the California Consumer Privacy Act, and lock your phone with a passcode that others in your household do not know.

When Should You Consult a Lawyer for a Privacy Breach?

You should consult a lawyer soon after discovering a privacy breach, because some California privacy claims must be filed within one year. The deadline for intrusion, disclosure, and appropriation claims is generally two years under Code of Civil Procedure section 335.1, while false light claims and claims under the Invasion of Privacy Act face a one year deadline. The timing of a data breach claim also matters because the California Consumer Privacy Act requires 30 days’ written notice to the business before a statutory damages lawsuit. A lawyer can send preservation demands before logs and posts disappear. Early advice helps when a breach notice arrives, since joining or opting out of a class action affects what you can recover individually.

Can a Personal Injury Attorney Handle Breach of Privacy Cases?

Yes, some personal injury attorneys handle breach of privacy cases, since privacy torts cause injury to the person through emotional distress, humiliation, and reputational harm. Personal injury attorneys who accept privacy matters apply the same skills they use in other tort cases, including proving damages and presenting emotional harm to a jury. The work a personal injury attorney does in a surveillance, secret recording, or public disclosure case closely resembles other intentional tort litigation. Data breach class actions under the California Consumer Privacy Act can require deeper experience with cybersecurity standards, forensic evidence, and class procedure. Ask any attorney you consult how many privacy cases the office has handled and whether those cases involved data breaches or personal violations.