More than half of legal decision-makers responsible for class actions believe data privacy and security will be the next wave of class actions, up from less than 30% in 2017. Most companies, however, have not faced a data privacy and security class action, and express moderate concern about facing one in the future. A large majority report that their company has an action plan in place to handle a data breach. According to the 2019 Carlton Fields Class Action Survey, the European Union’s new privacy law, the General Data Protection Regulation (GDPR), also has hit the radar of corporate counsel, but most are not concerned about GDPR exposure. Approximately two-thirds of companies, however, reported concern stateside about the California Consumer Privacy Act, a data privacy law that goes into effect in 2020.