On February 9, 2024, the Third Appellate District of California vacated a trial court decision, holding that the California Privacy Protection Agency (“CPPA”) could immediately begin enforcing the current version of the California Consumer Privacy Act (“CCPA”). As our readers are aware, the CCPA went into effect on January 1, 2022, with the aim of protecting the privacy of California consumers, in large part, by giving them “more control” over the collection, use, and sharing of their personal information.

On June 30, 2023, a California trial court held that the CPPA could not enforce the California privacy regulations until one year after they were finalized. Because the California privacy regulations were finalized on March 29, 2023, this meant that the CPPA would not be able to enforce them until March 29, 2024. By reversing the trial court’s decision, the Third Appellate District immediately restored the CPPA’s full enforcement authority.

Analyzing this Important California Privacy Decision

The origin of California Chamber of Commerce v. CPPA can be traced back to the implementation of Proposition 24, a measure approved by voters implementing the California Privacy Rights Act of 2020 (“CPRA”). The CPRA amended and expanded privacy protections for California consumers under the CCPA, in part, by “giving consumers the right to correct inaccurate personal information collected by a covered business and to limit a covered business’s use and disclosure of ‘sensitive personal information’ (e.g., social security number, racial or ethnic origin, religious beliefs, genetic data, precise geolocation) to specific identified purposes.” The CPPA published a notice of proposed rulemaking, informing the public of the CCPA’s new amendments. On March 29, 2023, the Office of Administrative Law approved the CPPA’S proposed final regulations. Plaintiff filed its challenge to enforcement of the new regulations the following day.

The trial court ultimately sided with Plaintiff, agreeing that, by approving Proposition 24, California voters intended for a one-year delay between the adoption and the enforcement of those regulations. The trial court determined that the clock would begin running on the date that newly-implemented California privacy regulations became final. On appeal, the Third Appellate District found that the trial court had ignored the plain language of the CPRA, which clearly specified July 1, 2023 as the date that any regulations enacted under it could be enforced. The Third Appellate District also found that “because there is no ‘explicit and forceful language’ mandating that the Agency is prohibited from enforcing the Act until (at least) one year after the Agency approves final regulations, the trial court erred in concluding otherwise.”

Shortly after this important California privacy rights decision was handed down, the agency responsible for said enforcement issued a statement. In its announcement, the CPPA expressed that it was “pleased” with the decision and took the opportunity to remind businesses affected by the new regulations to immediately evaluate their internal privacy practices to ensure full compliance.

What does the CPPA Decision Mean for your Business?

Michael Macko, Deputy Director of Enforcement for the CPPA made clear that the CPPA’s authority to enforce the CCPA was fully and immediately restored. As such, for businesses that were previously relying on the stay of enforcement, now is the time to ensure full compliance with the CCPA. The CCPA contains a whole host of regulations aimed at protecting the privacy rights of consumers and dictating how businesses must honor them. Businesses that do not comply are subject to significant administrative and civil penalties.

The CPPA moves quickly when it determines that a consumer privacy right needs protection. For example, on November 27, 2023, the CPPA released draft regulations governing how automated decision making technology (“ADMT”) should be used. On December 9, 2023, the CPPA signed off on the proposed regulations and advanced them to formal rulemaking. In this rapidly-changing regulatory climate, it is important that businesses consult with experienced data privacy attorneys to ensure compliance with state and federal privacy laws.

[View source.]