On June 30, 2023, the California Superior Court issued a decision blocking the California Privacy Protection Agency (“CPPA” or the “Agency”) from enforcing new regulations governing the collection and use of consumer data until March 2024.
The CPPA was set to start enforcing the final regulations this month. But the California Chamber of Commerce sued, arguing that the underlying law—the California Privacy Rights Act (“CPRA”)—required the Agency to provide businesses with more time to prepare to comply with the new regulations before enforcement could begin. The court agreed, holding that the plain text of the CPRA requires the CPPA to wait a year after promulgating the final rules to begin enforcing them.
The CPRA, which was approved as a ballot initiative by California voters in 2020, establishes heightened standards regarding the collection, retention, and use of consumer data by businesses that either have an annual gross revenue in excess of $25,000,000, buy, sell, or share a certain threshold of consumer or household personal information, or derive at least 50% of their annual revenue from selling personal information. Among other things, the CPRA delegated the administrative authority for implementing and enforcing the California Consumer Privacy Act (“CCPA”) and the CPRA to the CPPA. Long-time readers of the blog are likely familiar with both the CPRA and the CCPA from our extensive prior coverage.
The CPRA specifies that the CPPA must adopt final regulations by July 1, 2022 and authorizes the CPPA to begin enforcing the law on July 1, 2023. The CPPA, however, did not finalize any regulations under the law until March 29, 2023, and has yet to finalize regulations relating to cybersecurity audits, risk assessments, and automated decision-making technology. Despite missing the statutory July 1, 2022 deadline for adopting final regulations, the Agency planned to enforce the law and the final regulations starting on July 1, 2023.
In reaching its decision, the court found that the text of the CPRA “indicates the voters intended there to be a gap between the passing of final regulations and enforcement of those regulations.” If the CPPA were to begin enforcing the regulations on July 1, 2023, about three months after it adopted the final regulations, businesses subject to the CPRA would have “no time to come into compliance,” which “would not be in keeping with the voters’ intent.” Accordingly, the court concluded that the CPPA “may begin enforcing those regulations that became final on March 29, 2023 on March 29, 2024.”
At the same time, the court rejected the California Chamber of Commerce’s request to delay enforcement of the CPRA as a whole, reasoning that to do so would also “thwart the voters’ intent.” Thus, while the CPPA must wait a year after finalizing a particular regulation before enforcing that regulation, it does not have to delay enforcement until all regulations are finalized.
In sum, the court’s decision gives businesses subject to the CPRA additional time to comply with the final regulations. Although the CPPA may not enforce the regulations it adopted on March 29, 2023 for another nine months, it can still enforce other privacy regulations and bring enforcement actions under the CPRA and the CCPA. Moreover, California consumers may still bring civil suits under the CCPA’s private right of action. Finally, with less than a year to go before the new regulations can be enforced, affected businesses should start preparing now.
As always, we will continue to monitor any developments relating to the CCPA, CPRA and CPPA.
