Overview
On June 30, 2023, the California Superior Court hearing Cal. Chamber of Commerce v. Cal. Privacy Prot. Agency, No. 34-2023-80004106 (Cal. Sup. Ct.), delayed enforcement of the latest California Consumer Privacy Act (CCPA) regulations until March 29, 2024. The ruling does not, however, impact enforcement of the CCPA itself or the regulations previously adopted by the California Attorney General.
In Depth
The court concluded that it was the intent of the California voters who approved the California Privacy Rights Act (CPRA) by ballot initiative in 2020 to give businesses 12 months between the finalizing of any CCPA regulation and the start of enforcement. As a result, enforcement of any final regulation that the California Privacy Protection Agency (CPPA) promulgates—including on future topics—can only occur 12 months after finalizing such regulation.
The court, however, rejected the broader relief that the California Chamber sought. In addition to a 12-month enforcement delay, the California Chamber had sought an order requiring a stay of any enforcement of any CCPA regulation promulgated by the CPPA until the CPPA had finalized all the regulations required by the CCPA.
Because it was not the subject of the California Chamber’s writ, this ruling does not impact the California Attorney General’s or the CPPA’s ability to enforce the CCPA itself or the CCPA regulations previously finalized by the California Attorney General. As a result, as of July 1, 2023, the California Attorney General or the CPPA can enforce both the CCPA as amended by the CPRA as well as the California Attorney General’s previously finalized CCPA regulations.
In short, what this ruling has bought companies is time. Many companies sprinted to comply with CCPA regulations, finalized in March of this year, which often added significant details beyond the CCPA statutory text. The result has often been imperfect from an operational standpoint. Companies now can evaluate their CCPA compliance programs holistically and build programs that not only meet the requirements of the CCPA regulations but do so in an operationally sustainable manner.
***
Creating a successful and effective privacy program will save organizations time in the long run, especially given the similarities across these laws. If you have questions or need assistance in readiness work for the new state consumer laws, please contact your regular McDermott lawyer or reach out to Elliot Golding, Amy Pimentel or David Saunders.
Check out our additional coverage on new state consumer privacy laws:
Oregon Joins the Consumer Privacy Trend
Texas Consumer Privacy Law Nears Governor’s Signature
Florida Adds a New Twist to Consumer Privacy Patchwork
Tennessee Joins the Fray as Legislature Passes Consumer Privacy Law
Consumer Privacy Law Comes to Big Sky Country as Montana Passes New Law
Indiana Passes Consumer Privacy Bill
Iowa’s New Privacy Law: The Basics
Colorado Finalizes Sweeping New Privacy Rules; Iowa Joins the Fray
Preparing for New Consumer Privacy laws in Colorado, Connecticut and Utah
