On March 30, 2023, the California Privacy Protection Agency (Agency) announced that the California Office of Administrative Law (OAL) approved the Agency’s first substantive CCPA rulemaking package. The approved regulations, which are immediately effective, can be enforced beginning July 1, 2023.

According to the Agency, the “regulations have not changed substantively since the Agency Board voted on modifications made at its October 29, 2022 meeting.” The text of the final regulations and supporting materials were not immediately available, but will be posted here once processed. Members of Husch Blackwell’s privacy and cybersecurity practice previously hosted a webinar analyzing the final regulations, which is accessible here.

The OAL’s approval concludes an eighteen-month rulemaking process that began in September 2021 with the Agency soliciting preliminary comments from the public via an initial Invitation for Comments. The Agency issued draft regulations on May 27, 2022, and commenced formal rulemaking on July 8, 2022.

The OAL’s approval also comes roughly twenty-seven months after the Agency was officially established on December 16, 2020. On that date, California Secretary of State certified the results of the November 2020 election in which California voters passed Proposition 24 – the California Privacy Rights Act of 2020.

Notwithstanding today’s approval, the Agency already has begun additional rulemaking. In February, the Agency issued an Invitation for Preliminary Comments on Proposed Rulemaking on cybersecurity audits, risk assessments, and automated decision-making.

The OAL’s approval of the first rulemaking package is another significant milestone in the development of US privacy law. Combined with the Colorado Attorney General office’s recent finalization of Colorado Privacy Act (CPA) rules and the upcoming effective dates of the CPA and Connecticut Data Privacy Act, the US is entering into a new era of privacy law.

[View source.]