At its February 3 meeting, the California Privacy Protection Agency (CPPA) Board took steps pursuant to the California Privacy Rights Act (CPRA) towards (1) finalizing its updated California Consumer Privacy Act (CCPA) regulations and (2) launching a new rulemaking to develop rules for cybersecurity audits, risk assessments, and automated decisionmaking.
As we previewed in our recent webinar on Staying Ahead of State Privacy Laws, both efforts will add to the already complex, California-specific data privacy framework, with significant impacts for covered businesses. Below, we summarize these updates, which businesses should continue to monitor closely.
Updated CCPA Regulations
Since last year, the CPPA has been working to update the CCPA regulations, with several rounds of informational sessions, drafts, public comments, and meetings. At last week’s meeting, the CPPA Board took an important step in this process: it unanimously passed a motion to adopt and approve a rulemaking package and authorize agency staff to submit the package to the California Office of Administrative Law (OAL) for review and approval before the regulations are finalized.
The draft rulemaking package includes a list of edits and additions to the existing rules, as well as an explanation of the changes to the rules (Final Statement of Reasons). The new changes address the following topics:
- Restrictions on the collection and use of personal data;
- Disclosures to consumers;
- Methods for obtaining consumer consent;
- Privacy policies and notices at collection;
- The rights to opt out of sharing and the processing of sensitive personal information;
- The right to correct;
- The use of opt-out preference signals;
- Service provider and contractor contract requirements;
- Third party contract requirements;
- CPPA investigation and enforcement powers; and
- Additional adjustments to the existing regulations.
Of note, the current draft rules may still be subject to further change and delays before they become effective. The Board’s motion on Friday also authorized agency staff to withdraw the draft rules in full or in part if the regulations merit further Board consideration. The Board’s general counsel explained that OAL may require additional modifications, and that substantive changes would require further agency deliberation and another 15-day comment period.
In terms of timing, the CPRA created a rulemaking deadline of July 1, 2022, but the process has moved at a slower pace. With this latest development, the Board discussed that it expects to be able to submit the final rules package to OAL within the next two weeks, and it noted that OAL review typically takes about 30 business days.
Further Rulemaking Regarding Cyber Audits, Risk Assessments, and Automated Decisionmaking
In addition to general updates to the CCPA rules, the CPRA also tasks the CPPA with promulgating rules on cybersecurity audits, risk assessments, and automated decisionmaking. To date, the agency has not officially launched this second rulemaking, but at last week’s meeting, the Board unanimously passed a motion to move the process forward. Specifically, the motion adopted authorizes the agency to publish a set of rulemaking questions for public comment. Once the official questions have been issued, commenters will have 45 days to provide input. The comment deadline will be listed in the issued invitation.
This second set of rulemaking topics will likely kick off another flurry of meetings, hearings, and releases of draft regulations, much like the last tranche of regulatory topics.
***
As California’s privacy laws and regulations continue to develop, compliance obligations continue to be a moving target. It is increasingly important for affected companies to track these regulatory developments—as well as emerging legal and regulatory developments in other states—to understand their current and future compliance burdens.
[View source.]
