Background

Enforcement of the California Privacy Rights Act of 2020 (CPRA) Final Regulations by the California Privacy Protection Agency was put on hold June 30, 2023, by a California Superior Court, just before enforcement was scheduled to begin.[1] Businesses are now grappling with how the Superior Court's decision will impact their compliance efforts and potential exposure for non-compliance.

This alert provides an overview of recent California privacy legislation, key takeaways on the scope of that legislation, and insight into the operational impact that the Chamber of Commerce decision will have on businesses.

An Overview of California's Dynamic Privacy Legislation

The CCPA, originally introduced as a 2017 ballot initiative, was instead enacted as a statute by the California legislature in 2018 and became enforceable January 1, 2020.[2] The CCPA required the California Attorney General to finalize regulations implementing the Act by July 1, 2020.[3] The Attorney General issued several sets of regulations and modifications, the last of which was issued on March 15, 2021, and became effective immediately.[4]

Unsatisfied with the CCPA, California voters approved Proposition 24—the California Privacy Rights Act of 2020 (CPRA)—in November 2020.[5] The CPRA amended the CCPA, establishing new standards concerning consumer data and creating the California Privacy Protection Agency.[6] This new Agency assumed rulemaking and enforcement authority previously granted to the Attorney General. The CPRA became effective January 1, 2023.[7]

The CPRA required the passage of supplemental regulations to implement its requirements in fifteen key areas by July 1, 2022, with enforcement beginning July 1, 2023, a full year after their finalization.[8] The Agency did not issue a proposal until July 8, 2022, and even then, only included regulations for 12 of the 15 contemplated areas.[9] These regulations were finalized on March 29, 2023, nearly nine months after the statutory deadline.[10]

The Agency maintained that the 12 finalized areas were enforceable after July 1, 2023.[11] However, the Agency conceded the three unfinalized areas—cybersecurity audits, risk assessments, and automated decision-making—would not be enforced until completed.[12] The California Chamber of Commerce submitted a comment letter arguing that the Agency exceeded its authority and violated the requirement that the Agency finalize regulations covering all 15 topics by July 1, 2022, coupled with a one-year grace period.[13] The Chamber subsequently commenced suit, arguing that businesses would be unfairly prejudiced if the Agency were to enforce the regulations as soon as July 1, 2023.[14]

Superior Court Balances the Interests of Consumers and the Agency

Key Takeaways:

• Final regulations get a one-year grace period between finalization and enforcement.
• The 12 final CPRA regulations are enforceable March 29, 2024.
• The CPRA's cybersecurity audit, risk assessment, and automated decision-making regulations will not be enforceable until one year after they are finalized.

The Superior Court decided in favor of the Chamber. Judge Arguelles, writing for the court, stated that California voters clearly intended to provide businesses with a 12-month gap or "grace period" to tailor compliance efforts to any new final regulations.[15] The court stayed enforcement of the Agency's CPRA regulations "for 12 months after that individual regulation is implemented."[16] As a result, the Agency's 12 final CPRA regulations may not be enforced until March 29, 2024, and the regulations implementing each of the three CPRA topics not yet addressed will require separate year-long grace periods before they are enforceable.[17]

The court declined to mandate any specific date by which the Agency must finalize the remaining regulations.[18] As a consequence, businesses must now pay attention to the moving target of staggered enforcement dates as the remaining CPRA regulations are finalized in the coming months.

Scope of the Holding in California Chamber of Commerce

Key Takeaways:

• The Attorney General's regulations are still enforceable until the new Agency regulations become effective.[19]
• The text of the CCPA, as modified by the CPRA, is currently enforceable.

Businesses should be aware that this ruling does not impose an expansive stay on all enforcement of California privacy law. Instead, the court expressed that "regulations previously passed pursuant to the CCPA [by the AG] will remain in full force and effect until superseding regulations passed by the Agency become enforceable in accordance with the court's order," per the plain language of the CPRA.[20]

This means that significant provisions of both the CCPA and CPRA will remain in effect and enforceable under California law, even during the grace period. Although the court's decision temporarily restricts some enforcement activities by the Agency, the Agency and the Attorney General are still able to engage in enforcement activities not impacted by the order until the year-long grace period for the Agency's final regulations has tolled.

The most important takeaway is that businesses should not pause CCPA and CPRA compliance efforts. This holding creates good arguments against some challenges to a company's privacy compliance, but it will not shield a business from enforcement altogether. The Superior Court's decision could also be subject to an automatic stay of its own, if the Agency's appeal is successful. This might render the final regulations enforceable after all, pending the appeal.[21]

California Consumer Privacy Act Enforcement

Key Takeaways:

• The California AG still is enforcing against businesses that have not updated their privacy practices under CCPA.
• The Agency has appealed the order restricting enforcement of the new regulations that were finalized in March of this year.

On July 14, 2023, the Agency held a public meeting to discuss various issues, including the progress towards finalizing the remaining three areas of regulation. The Agency discussed each of the three topics and noted that it invited preliminary public comment on February 10, 2023. The Agency made clear that the formal rulemaking process had not yet started.

Meanwhile, California Attorney General Rob Bonta is showing no sign of slowing enforcement of privacy protections guaranteed to California residents. While the Agency held its public meeting, the Attorney General issued a press release stating "[w]e are sending inquiry letters to learn how employers are complying with their legal obligations."[22]

The Agency recently filed an appeal of the Superior Court's decision. Now, businesses are left with the outcome of the Agency's appeal. While we wait for a resolution, businesses should remain on the lookout for regulations in the three remaining areas and, if enforcement is no longer stayed, new enforcement actions by both the Agency and the Attorney General. Most importantly, businesses should diligently continue their compliance efforts while keeping an eye on the new scheme of staggered enforcement phases. We will continue to monitor CCPA/CPRA developments and keep you informed as new events unfold.

[1] California Chamber of Commerce v. California Privacy Protection Agency, No. 34-2023-80004106-CU-WM-GDS (Cal. Super. June 30, 2023) (J. Arguelles Minute Order).

[2] California Consumer Privacy Act of 2018, 2018 Cal Stats. Ch. 55 (codified as Cal. Civ. Code tit. 1.81.5 (2018)). 

[3] Cal. Civ. Code § 1798.185(a).

[4] See Press Release, Office of the Attorney General, Attorney General Becerra Announces Approval of Additional Regulations That Empower Data Privacy Under the California Consumer Privacy Act (Mar. 15, 2021), https://oag.ca.gov/news/press-releases/attorney-general-becerra-announces-approval-additional-regulations-empower-data.

[5] See Minute Order at 2.

[6] Id.

[7] See The California Privacy Rights Act of 2020.

[8] Minute Order at 2.

[9] Id.

[10] Id.; see Cal. Civ. Code § 1798.185(d).

[11] Minute Order at 2 ("The Agency has publicly stated it will not be enforcing the law in these areas until the Agency has finalized applicable regulations. It does, however, intend to enforce the law in the other twelve areas as soon as July 1, 2023.").

[12] Id.

[13] See California Chamber of Commerce, Public Comment Letter on California Consumer Privacy Act Regulations at PDF2 – 7-21 (Aug. 22, 2022), https://cppa.ca.gov/regulations/pdf/comments_26_50.pdf; see Minute Order at 3.

[14] Minute Order at 3.

[15] See id. at 4-5.

[16] Id. at 5.

[17] Id. ("By way of example, if an Agency regulation passes . . . on October 1, 2023, the Agency will be prohibited from enforcing a violation of said regulation until October 1, 2024.").

[18] Id. ("The court declines to mandate any specific date by which the Agency must finalize regulations.").

[19] Id. ("Consistent with the plain language of Section 1798.185, subdivision (d), regulations previously passed pursuant to the CCPA will remain in full force and effect until superseding regulations passed by the Agency become enforceable in accordance with the Court's Order.").

[20] Id.

[21] See Cal. Code Civ. Proc. § 916 ("the perfecting of an appeal stays proceedings in the trial court upon the judgment or order appealed from or upon the matters embraced therein or affected thereby"); Cal. Code Civ. Proc. § 1094.5 ("However, in cases where a stay is in effect at the time of filing the notice of appeal, the stay shall be continued by operation of law for a period of 20 days from the filing of the notice. If an appeal is taken from the granting of the writ, the order or decision of the agency is stayed pending the determination of the appeal unless the court to which the appeal is taken shall otherwise order.").

[22] Press Release, Office of the Attorney General, Attorney General Bonta Seeks Information from California Employers on Compliance with California Consumer Privacy Act (July 14, 2023), https://oag.ca.gov/news/press-releases/attorney-general-bonta-seeks-information-california-employers-compliance.