Enforcement of CPRA Regulations Delayed but Don’t Abandon Privacy
Background
The day before the California Privacy Rights Act (CPRA) became enforceable on July 1, we learned that enforcement of the first set of implementing regulations finalized by the California Privacy Protection Agency (CPPA) under the CPRA (Regulations) is delayed until March 29, 2024. Prior to the June 30 ruling by a California Superior Court judge (the Ruling), the Regulations were set to become immediately effective on the CPRA's July 1 effective date.
Staying the Course
While the Ruling provides businesses with several more months to comply with the highly prescriptive Regulations, businesses should refrain from seeing this as an opportunity to abandon privacy compliance efforts—even those that are based on the Regulations. It appears clear that the Ruling applies only to the Regulations themselves and not to the statutory text nor to prior regulations issued by the California Attorney General, both of which are currently enforceable. The Regulations are helpful in signaling the CPPA's intent with respect to enforcement of the statute, and thus, the Regulations and statute are best interpreted in tandem.
Beyond March 2024
The Ruling confirmed that a period of delay would also apply to future CPPA regulations. Because the Regulations only address 12 of the 15 areas for which the CCPA is to promulgate regulations, new regulations are to come covering the three additional areas—cybersecurity audits, risk assessments, and automated decision-making. Under the reasoning of the Ruling, any such new regulations will not be directly enforceable until 12 months after the full rulemaking process is completed and the regulations are implemented.
The CPPA meets next on July 14, 2023, and our team of privacy lawyers will continue to keep clients updated on new developments.
© 2023 Perkins Coie LLP
Print and share
Authors
Notice
Before proceeding, please note: If you are not a current client of Perkins Coie, please do not include any information in this e-mail that you or someone else considers to be of a confidential or secret nature. Perkins Coie has no duty to keep confidential any of the information you provide. Neither the transmission nor receipt of your information is considered a request for legal advice, securing or retaining a lawyer. An attorney-client relationship with Perkins Coie or any lawyer at Perkins Coie is not established until and unless Perkins Coie agrees to such a relationship as memorialized in a separate writing.
Notice
Before proceeding, please note: If you are not a current client of Perkins Coie, please do not include any information in this e-mail that you or someone else considers to be of a confidential or secret nature. Perkins Coie has no duty to keep confidential any of the information you provide. Neither the transmission nor receipt of your information is considered a request for legal advice, securing or retaining a lawyer. An attorney-client relationship with Perkins Coie or any lawyer at Perkins Coie is not established until and unless Perkins Coie agrees to such a relationship as memorialized in a separate writing.
Notice
Before proceeding, please note: If you are not a current client of Perkins Coie, please do not include any information in this e-mail that you or someone else considers to be of a confidential or secret nature. Perkins Coie has no duty to keep confidential any of the information you provide. Neither the transmission nor receipt of your information is considered a request for legal advice, securing or retaining a lawyer. An attorney-client relationship with Perkins Coie or any lawyer at Perkins Coie is not established until and unless Perkins Coie agrees to such a relationship as memorialized in a separate writing.
Notice
Before proceeding, please note: If you are not a current client of Perkins Coie, please do not include any information in this e-mail that you or someone else considers to be of a confidential or secret nature. Perkins Coie has no duty to keep confidential any of the information you provide. Neither the transmission nor receipt of your information is considered a request for legal advice, securing or retaining a lawyer. An attorney-client relationship with Perkins Coie or any lawyer at Perkins Coie is not established until and unless Perkins Coie agrees to such a relationship as memorialized in a separate writing.