The California Privacy Protection Agency (“CPPA”) announced during its Board meeting on December 16, 2022 that the regulations implementing the California Privacy Rights Act (“CPRA”) will not likely go into effect until April 2023.
CPPA Executive Direct Ashkan Soltani stated that the CPPA Staff plans to publish the final draft of the CPRA regulations in late January. If the Board approves the Staff’s draft without making any changes, the CPPA will be able to submit the final rulemaking package, including a Final Statement of Reasons, to the California Office of Administrative Law (“OAL”) in mid-February. OAL will then have 30 business days to review the package, and the regulations will immediately go into effect upon OAL’s approval.
Director Soltani noted that the Staff’s final draft will not include any substantive changes from the Modified Text of Proposed Regulations the CPPA published on November 3. It remains uncertain, however, whether the Board will approve the regulations without further modifications or delay. While the CPPA has acknowledged time is of essence, there has been considerable discussions among the Board members on whether the current draft regulations sufficiently protect California consumers. For example, during the CPPA’s October Board meeting, Board member Lydia de la Torre urged the Board to engage in a meaningful deliberation to further improve the regulations, even though the Board must “finalize [the regulations] as soon as possible.” Her concerns included the lack of clarity surrounding the term “reasonably necessary and proportionate,” which she worried bad actors could exploit to bypass CPRA’s data minimization principles.
Although the CPPA has not finalized the CPRA regulations, businesses should note that CPRA’s statutory provisions will go into effect on January 1, 2023. Moreover, the current regulations promulgated under the California Consumer Privacy Act remain effective.
Alston & Bird’s Privacy, Cyber & Data Strategy Team will continue to monitor developments surrounding CPRA rulemaking and provide updates as more information becomes available.
[View source.]
