Although California law doesn't assess any penalties against an entity that doesn't follow the notification law, it does permit a person a private cause of action against those entities. People can sue the private entity for any damages they have because they didn't receive notification in a timely manner. True or false?

True

Reason:

state agency, or a person or business that conducts business in California, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, any breach of the security of the data, as defined, to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person." In addition, the law permits delayed notification "if a law enforcement agency determines that it would impede a criminal investigation." The law also requires any entity that licenses such information to notify the owner or licensee of the information of any breach of the security of the data.