On Friday, December 8, 2024, the California Privacy Protection Agency (Agency) will meet to discuss important items, including drafting proposed regulations for employers. While the Agency has not yet commenced the formal rulemaking process on many of the regulations, the current drafts are meant to help facilitate discussion. 

The draft California Consumer Privacy Act (CCPA) regulations reveal important expansions, if implemented. For example:

1. expanding the definition of sensitive personal information to include persons under 16 years of age;
2. allowing consumers to request information about the consumer that a company shares;
3. creating an annual adjustment for monetary thresholds, such as the revenue threshold and penalty requirement, based on the consumer pricing index; and
4. requiring businesses to ensure that information remains deleted, deidentified, or aggregated – or risk non-compliance with a request to delete.  

While some of the proposed regulations include helpful illustrative examples, many do not. Other proposed regulations relate to cybersecurity audits, risk assessments, and automated decision-making processes. 
The Agency’s will hold a closed session to obtain its counsel’s guidance about the CalChamber case. The Appeal seeks to overturn the trial court’s decision to delay enforcement. There is also a pending petition for writ of mandate.