The long wait—two excruciating months from the end of initial public comment—is over. The California Attorney General’s office, in a bid to ruin the weekend for privacy professionals around the country, released modified CCPA regulations late in the work day on Friday, February 7. Dutifully, we took a look. And suffice it to say, we were quite surprised at the extent of the makeover.
Previously, we thought there was a good chance the modifications to the regulations would be limited. Attorney General Xavier Becerra had even stated that no “major” changes were planned to the proposed regulations. But the redline version (a public good for which we can’t express enough gratitude to the AG’s office) has so many strikethroughs and red additions that the regulations have the appearance of a confused tiger.
The implication of all those changes is that the Attorney General’s office took seriously the approximately 1,700 pages of comment submitted by the public, not to mention the hours and hours of public hearings. And for that, the tireless individuals in that office (who, remember, have a large swath of other California laws they must administer and enforce) should be applauded.
So, you ask, what’s the final tally? The changes, overall, look like they will reduce compliance burdens compared to the regulations as they were first proposed. We won’t provide an exhaustive list, but here are the things that most caught our eyes:
The public-comment period is once again open, until 5:00 p.m. Pacific on February 25. After that, assuming no further modifications and additional public-comment periods, if the process is wrapped up and final regulations are filed with the California Secretary of State by May 31, then we’ll have an effective date of July 1, 2020—the same day the Attorney General’s office will begin enforcing the CCPA.