This summer California enacted, effective Jan. 1, 2020, the California Consumer Privacy Act (CCPA), a privacy law unprecedented in the U.S. that grants California residents a broad range of European-like privacy rights. Amendments passed as SB 1121 on Aug. 31 and signed into law by Gov. Brown on Sept. 23 extend the time for the California attorney general (CaAG) to promulgate regulations to July 1, 2020, push back enforcement until the earlier of that date or six months from issuance of the regulations, and remove the CaAG’s ability to intervene in private lawsuits – changes made at the request of the CaAG. Fortunately for industry, the CaAG’s recommendation that the CCPA’s limited private right of action be expanded was rejected, and language was even added to clarify the limits of consumer lawsuits. The U.S. Chamber of Commerce is lobbying Congress to pass a federal omnibus privacy and data protection law that would pre-empt the CCPA and other existing and future state data protection laws. See its proposal and statement here. The Internet Association, a trade group that represents leading internet companies, has also released a proposed framework for federal legislation. Most recently, on Sept. 24, the Interactive Advertising Bureau, with 650 digital advertising industry members, joined in the calls for a federal omnibus law to pre-empt CCPA in a letter to the Senate committee exploring such a bill.

Assuming no federal pre-emption, companies need to begin preparing for the CCPA. To comply with the 12-month look back for consumer requests as of the law’s effective date, businesses will need to start data mapping and record keeping of personal information as of Jan. 1, 2019. Depending on how long it takes to promulgate the regulations, businesses could get up to a six-month delay in enforcement; so a case for waiting to start compliance efforts until Q1 2019 can be made, which may help with budgeting the expense. See our prior post here for how to begin to get ready for the CCPA. In the coming months, we will hold a series of seminars on the CCPA and how to build a CCPA compliance program. We will also continue to track efforts to further amend the CCPA, federal legislation that may supplement or pre-empt it, attempts at similar legislation in other states, and the CCPA rule-making process about to be kicked off by the CaAG.