On June 30, 2023, a court in Sacramento issued an order enjoining enforcement of the implementing regulations promulgated by the California Privacy Protection Agency (CPPA) under the California Privacy Rights Act of 2020 (CPRA). If the order stands, enforcement will be delayed until March 29, 2024.
This ruling is the result of the California Chamber of Commerce (Chamber) filing a lawsuit against the CPPA seeking a delay in the enforcement of the regulations passed by the CPPA on March 29th of this year. The CPPA made it clear that it intended to enforce the regulations as soon as July 1, 2023. The Chamber argued that the CPPA regulations should only be enforceable 12 months from the final promulgation of all required regulations set out in the CPRA and sought injunctive relief. Under the CPRA, the CPPA is required to promulgate regulations across 15 new substantive areas, but to-date, has only done so across 12 areas.
The Chamber argued that the voters of CPRA intended that the CPPA issue final regulations covering all 15 areas by July 1, 2022, and that the intended enforcement date of July 1, 2023, would guarantee businesses one year from adoption before the CPPA began enforcing the regulations. The Court order gave a significant reprieve to businesses who process the data of California residents by finding that the voters did intend for there to be a 12-month delay from adoption to enforcement. For businesses subject to CPRA, this means that they now have an extra 9 months to comply with the regulations which cover a wide array of topics including consumer rights.
However, the Court did reject the Chamber’s argument that enforcement cannot start until all 15 areas of regulations are finalized. Instead, the Court found that there should be a 12-month delay after any individual regulation is implemented. The Court also recognized that the CPPA does not have a timeline for when the remaining 3 areas requiring regulation, namely cybersecurity audits, risk assessments, and automated decision-making technology, will be complete, and to push enforcement until those rules are promulgated is not in keeping with voter intent.
As such, the Court found that the CPPA may begin enforcing the regulations that became final on March 29, 2023, on March 29, 2024.
CounselTandy is counsel in the Litigation, Discovery, and Privacy & Data Security groups. She specializes in information management issues, including privacy and data security. Tandy uses her experience to help clients understand their ...
About Data Points: Privacy & Data Security Blog
The technology and regulatory landscape is rapidly changing, thus impacting the manner in which companies across all industries operate, specifically in the ways they collect, use and secure confidential data. We provide transparent and cutting-edge insight on critical issues and dynamics. Our team informs business decision-makers about the information they must protect, and what to do if/when security is breached.