The California Attorney General and the state’s privacy agency are seeking to overturn a judge’s opinion preventing enforcement of some updated elements of the landmark California Consumer Privacy Act until next March.
Their petition filed in the state’s Third District Court of Appeal advances several arguments, including that a Sacramento Superior Court judge’s privacy law ruling harms consumers and ignores the intent of voters who approved Proposition 24 in November 2020.
AG Rob Bonta and the California Privacy Protection Agency also argue that being blocked from enforcing some privacy regulations leaves businesses “free to violate critical privacy protections approved by the voters with impunity.”
“The superior court’s order prevents the enforcement of important aspects of Prop. 24, leaving tens of millions of California consumers without the vigorous enforcement commencing on July 1, 2023 that voters were promised,” the appeal filed on Aug. 4 states.
Background
Prop. 24, also known as the California Privacy Rights Act or CPRA, provided consumers with additional rights regarding the handling of their personal information and clarified other privacy law issues.
Additionally, the measure created the California Privacy Protection Agency to serve as a watchdog with enforcement powers.
Regulations the privacy agency put forward to implement the proposition and harmonize it with the existing privacy law known as CCPA were approved in late March and set to go into effect July 1 of this year.
The California Chamber of Commerce, also known as CalChamber, sued to delay enforcement of the regulations.
The chamber pointed to language in Prop. 24 it said indicated that voters wanted businesses to have one year from the adoption of final regulations before enforcement could begin.
The chamber also argued that all regulations should be finalized before enforcement by the newly created California Privacy Protection Agency could commence. There are three areas in which the privacy agency has not finalized regulations.
Judge’s ruling
Sacramento Superior Court Judge James Arguelles granted the requests of the chamber in part in a decision he issued on June 30.
He ruled that no finalized regulation pursuant to a specific section of Prop. 24 could be enforced by the state’s privacy agency “for 12 months after that individual regulation is implemented.”
As a result, regulations that were set to go into effect in a dozen areas on July 1, 2023, now do not become effective until March 29, 2024.
Judge Arguelles also wrote that “regulations previously passed pursuant to the CCPA will remain in full force and effect until superseding regulations passed by the agency become enforceable in accordance with the Court’s order.”
Regulatory ‘uncertainty’
In their appeal, the California AG and the state’s privacy agency are seeking expedited action from the appeals court because they claim “any relief that may be afforded by an appeal will largely be moot by the time the appeal completes its course.”
They also argue that the superior court’s order leaves “businesses and consumers in an untenable state of uncertainty regarding their privacy rights and obligations.”
“Insofar as the now enjoined Prop. 24 regulations amended and superseded regulations promulgated under the 2018 CCPA, it is unclear which regulations currently govern businesses,” the appeal states.
CalChamber’s reaction
CalChamber said in a statement from an in-house lawyer that it was “extremely disappointed” that the California privacy agency “has challenged the common sense of the trial court on this matter.”
“The agency’s failure to complete its rulemaking in a timely manner – as required by the voters in passing Proposition 24 – created this situation,” said Nicole Wasylkiw, corporate counsel at CalChamber. “The agency is attempting, again, to thwart the will of the voters and impose their own timeline.”
Business compliance implications
Aaron Tantleff, a Foley & Lardner partner in Chicago, said the delay in enforcement of some California privacy regulations has been well received by most clients and colleagues “as it helps ease the pressure on many as they continue their compliance efforts.”
However, he cautioned, businesses should not see the judge’s ruling as a hall pass to delay their compliance initiatives for another year.
“This delay does not strip the CA AG’s office of its ability to enforce key provisions under the CCPA, such as certain consumer rights under the CCPA, including do not sell and other rights,” Tantleff said in a statement to Legal Dive. “This delay only impacts those additional consumer rights provided for under the CPRA, such as the right to opt out of sharing (which is different than selling) and limiting disclosure of sensitive personal information.”
Ongoing enforcement
Tantleff said he expected the California AG’s Office to continue enforcing all aspects of the CCPA left unchanged by Prop. 24.
He highlighted Bonta’s announcement last month of an investigative sweep focused on whether large California employers are handling the personal information of employees and job applicants in compliance with CCPA.
Meanwhile, the California privacy agency has announced its first enforcement sweep focused on the data privacy practices of manufacturers that produce Internet-connected vehicles.
