Section 1798.150 of CCPA states: 'Any consumer whose nonencrypted and nonredacted personal information, as defined in subparagraph (A) of paragraph (1) of subdivision (d) of Section 1798.81.5, is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business's violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action …' Additionally, the protection of encryption keys is addressed in legislation related to CCPA. Notably, Assembly Bill 1130, which was introduced to update the California breach notification statute, requires notifying people whose data has been breached unless that data is encrypted, and the encryption keys have not been obtained with the data.