California Privacy Protection Agency Board Meets to Review the CPRA Rulemaking Process

Alston & Bird

Alston & Bird

On September 7 and 8, 2021, the California Privacy Protection Agency (“CPPA”) Board held a public virtual meeting regarding the rulemaking process under the California Privacy Rights Act (“CPRA”). The Board indicated that it expects to initiate preliminary rulemaking activities this fall, including soliciting public comments and holding informational hearings, and to publish a Notice of Proposed Rulemaking this winter, with public hearings to take place winter 2021 / spring 2022. CPRA requires the CPPA to adopt final regulations by July 1, 2022.

The Board presented an overview of the rulemaking process as follows.

  • The CPPA will first conduct preliminary rulemaking activities, including collecting written comments from the public and holding informational hearings.
  • The Agency will start the official rulemaking process by publishing an initial notice package that will include a notice of proposed rulemaking, an initial statement of reasons explaining the purpose and necessity of each regulation, and the text of regulations.
  • After the publication of the initial notice package, there will be a 45-day public comment period followed by a public hearing.
  • If there are any major changes made to the regulations following the 45-day public comment period, another 45-day public comment period will be initiated followed by a second public hearing. If additional changes are made and the changes are substantial and sufficiently related to the prior edits of the regulations, a 15-day public comment period will be initiated.
  • If there are no substantial changes made to the regulations, the Agency will then adopt the final text of regulations and submit it to the Office of Administrative Law for approval, with a target deadline of May 22, 2022.

To facilitate the rulemaking process, the Board’s Regulations Subcommittee proposed the creation of three rulemaking subcommittees: the CCPA Rules Update Subcommittee, the New CPRA Rules Subcommittee, and the Rulemaking Process Subcommittee. The CCPA Rules Update Subcommittee will update exiting rules to include CPRA requirements, such as additional requirements for opt-out requests and new data subject rights under the CPRA.  The New CPRA Rule Subcommittee will draft new rules on items not addressed in CCPA rules, such as cybersecurity audits, risk assessments, automated decision making, and agency audit authority. The Rulemaking Process Subcommittee will coordinate rulemaking activities and suggest additional topics for rulemaking.

[View source.]

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Alston & Bird | Attorney Advertising

Written by:

Alston & Bird

Alston & Bird on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.