On June 30, 2023, the California Superior Court hearing Cal. Chamber of Commerce v. Cal. Privacy Prot. Agency, No. 34-2023-80004106 (Cal. Sup. Ct.), delayed enforcement of the latest California Consumer Privacy Act (CCPA) regulations until March 29, 2024. The ruling does not, however, impact enforcement of the CCPA itself or the regulations previously adopted by the California Attorney General.

IN DEPTH

The court concluded that it was the intent of the California voters who approved the California Privacy Rights Act (CPRA) by ballot initiative in 2020 to give businesses 12 months between the finalizing of any CCPA regulation and the start of enforcement. As a result, enforcement of any final regulation that the California Privacy Protection Agency (CPPA) promulgates—including on future topics—can only occur 12 months after finalizing such regulation.

The court, however, rejected the broader relief that the California Chamber sought. In addition to a 12-month enforcement delay, the California Chamber had sought an order requiring a stay of any enforcement of any CCPA regulation promulgated by the CPPA until the CPPA had finalized all the regulations required by the CCPA.

Because it was not the subject of the California Chamber’s writ, this ruling does not impact the California Attorney General’s or the CPPA’s ability to enforce the CCPA itself or the CCPA regulations previously finalized by the California Attorney General. As a result, as of July 1, 2023, the California Attorney General or the CPPA can enforce both the CCPA as amended by the CPRA as well as the California Attorney General’s previously finalized CCPA regulations.

In short, what this ruling has bought companies is time. Many companies sprinted to comply with CCPA regulations, finalized in March of this year, which often added significant details beyond the CCPA statutory text. The result has often been imperfect from an operational standpoint. Companies now can evaluate their CCPA compliance programs holistically and build programs that not only meet the requirements of the CCPA regulations but do so in an operationally sustainable manner.

***

Creating a successful and effective privacy program will save organizations time in the long run, especially given the similarities across these laws.

[View source.]