It's actually a range between $100-$750 or actual damages, whichever is greater. [0] The law also specifically calls out in the next section that: "In assessin

It's actually a range between $100-$750 or actual damages, whichever is greater. [0] The law also specifically calls out in the next section that: "In assessing the amount of statutory damages, the court shall consider any one or more of the relevant circumstances presented by any of the parties to the case, including, but not limited to, the nature and seriousness of the misconduct, the number of violations, the persistence of the misconduct, the length of time over which the misconduct occurred, the willfulness of the defendant’s misconduct, and the defendant’s assets, liabilities, and net worth." So seems like an accidental breach of a not super sensitive piece of data might be treated with more nuance. [0] CCPA 1798.150.a (I linked to this in a comment above)