As previously discussed in an article titled “Privacy Gone Public: How growing push for privacy laws may affect U.S. businesses,” California implemented a new consumer protection law known as the California Consumer Privacy Act (CCPA) that went into effect this year. Although the regulations implementing the law are still being drafted, the deadline for enforcement of the law looms. And businesses should be aware that the current COVID-19 situation is not delaying the implementation of the regulations as of the time of this writing. Below is an outline of where things stand, so please be advised that now is the time to take proactive steps and contact counsel. Your company may have as few as two months to comply with the proposed regulations, once finalized.

Generally speaking, the CCPA applies to companies that do business in California and either a) have annual gross revenues in excess of $25 million; b) buy or sell the personal information of 50,000 or more consumers in California; or c) derive 50 percent or more of their annual revenue from selling California consumers’ personal information. The CCPA grants California consumers fairly broad rights to request information from such businesses regarding how they collect and use personal information.

Although the CCPA took effect in January, the California Attorney General’s office is not authorized to bring enforcement actions under the law until July. The California AG’s office released a third draft of proposed regulations on March 11th, with the comment period for the most recently proposed modifications running until March 27th. Once all comments have been received, it will likely take until late April before the regulations are finalized, meaning the best case for businesses subject to the law is that they will have roughly two months to ensure that their processes are compliant with the new regulations.

The short compliance period is obviously exacerbated by the fact that many companies have large portions of their workforces working remotely due to COVID-19. In recognition of this fact, more than 60 California and national trade associations and other organizations wrote a letter to the AG’s office last week, urging the AG’s office to push off the enforcement date to January 2, 2021. However, the AG’s office has indicated that it plans to move forward with enforcing the law either when the regulations are finalized or on July 1st, whichever comes first. It should be noted that the text of the CCPA does not allow enforcement actions to be brought prior to July 1st.  Companies subject to the CCPA should monitor the regulatory process and continue to work toward compliance to the extent possible.