[co-author: Jenny Ha]

On May 26, 2022, the California Privacy Protection Agency (CPPA or the Agency) held a public board meeting to provide updates on the Agency’s rulemaking process. The next day, the CPPA released draft regulations for the California Privacy Rights Act (CPRA). This post includes initial impressions of the proposed regulations and how they square with the board’s discussion of the rulemaking process during the May 26 meeting. Our full analysis of the newly released proposed regulations is forthcoming.

Update on CCPA Rules

The Update of CCPA Rules Subcommittee, comprised of Chairperson Jennifer M. Urban and Board Member Angela Sierra, discussed how the existing California Consumer Privacy Act (CCPA) rules would be amended to update definitions, to reorganize the requirements to make them easier to follow, and to accommodate new consumer rights, such as the right to correct. In the draft CPRA regulations released last week, the overall structure and a significant number of sections remained mostly unchanged. However, there are also many material updates to the existing CCPA regulations that will require businesses to reexamine CCPA compliance programs. These include stricter rules around processes for submitting consumer rights requests, new obligations for businesses that claim aspects of compliance would involve disproportionate effort, and significant updates to the procedures for opting out of sales of personal information.

Update on CPRA Rules

At the May 26 meeting, the New CPRA Rules Subcommittee, comprised of board members Lydia de la Torre and Vinhcent Le, stated that the current package of rules prioritized setting out the administrative enforcement process and the Agency’s audit authority. As a result, the following topics were not included in the Agency’s initial rulemaking package: rules on cybersecurity audits, privacy risk assessments and automated decision-making. The subcommittee did not commit to a deadline for publishing the additional rules.

Public comments during the May 26 meeting reflected the frustration felt by many businesses as a result of the delayed rulemaking process and concerns that the Agency will not have adequate time to receive feedback. As with prior meetings, the board gave no indication that there would be any grace period for businesses scrambling to meet the CPRA’s Jan. 1, 2023 operative date.

Update on Rulemaking Process

The Rulemaking Process Subcommittee, comprised of board members Lydia de la Torre and J. Christopher Thompson, presented a proposal for how the rulemaking process may unfold.

• First board meeting. Draft of regulations and initial statement of reasons (ISOR) presented. Board votes to approve filing notice package with the California Office of Administrative Law (OAL).
• Notice of Proposed Rulemaking.
• 45-day (minimum) public comment period.
  • Second board meeting. Substantive discussion of the draft rules.
  • Additional meeting. Likely to mirror the structure of the stakeholder sessions held previously, where the meetings are Agency-driven and do not require a quorum, but the board and the public may participate to give each other feedback and guidance.
  • Public hearings.
  • Additional public comment and hearings as required.
• Final meeting. Rule approval and board vote to approve the filing of the final package with the OAL.
• Final package submitted.

While the board members were supportive of the additional board meetings in this process, Executive Director Ashkan Soltani expressed concern about the members’ ability to adhere to such a demanding meeting timeline. The board also discussed the possibility of extending the public comment period to allow the public ample time to comment.

For a visual of the proposed rulemaking process, please find the presentation here.

Budget and Hiring Updates

The Agency’s 2022-23 budget proposal submitted in March is still pending. The Legislature must approve it by June 15, 2022. The Agency seems to be rapidly hiring and growing, and it is hoping to bring on more legal staff in the coming weeks.

Next Steps The board’s next meeting is set for June 8, 2022, and the agenda includes further discussion of the rulemaking process as well as discussion of the proposed CPRA regulations. The draft is likely to undergo several changes before the regulations are adopted, and we will continue to monitor the rulemaking process and the board’s actions on the draft regulations.

[View source.]