A state court judge in Sacramento has given businesses a reprieve from complying with some new elements of the California Consumer Privacy Act (CCPA) that were set to go into effect on July 1 of this year.
Enforcement of the rules covering how businesses collect and handle consumers’ personal information will instead be delayed until March 2024.
The regulations promulgated to harmonize CCPA with voter-approved Proposition 24, which is also known as the California Privacy Rights Act (CPRA), were approved in late March.
Soon after, the California Chamber of Commerce sued to delay enforcement by pointing to language in the proposition it said indicated voters wanted businesses to have one year from the adoption of final regulations before enforcement could begin.
The chamber also argued that all regulations should be finalized before enforcement by the newly created California Privacy Protection Agency could commence.
Sacramento Superior Court Judge James Arguelles granted the requests of the chamber in part in a decision he issued on June 30.
He ruled that no finalized regulation pursuant to a specific section of Proposition 24 could be enforced by the state’s privacy agency “for 12 months after that individual regulation is implemented.”
Arguelles said in his ruling that language in the proposition demonstrated voters “intended there to be a gap between the passing of final regulations and enforcement of those regulations.”
However, the judge also ruled that he would not delay enforcement until all regulations are finalized. As a result, Arguelles wrote that “regulations previously passed pursuant to the CCPA will remain in full force and effect until superseding regulations passed by the Agency become enforceable in accordance with the Court’s Order.”
On March 29, the Office of Administrative Law in California approved regulations in 12 of 15 areas contemplated by Proposition 24. Under the judge’s ruling, those regulations can start being enforced on March 29, 2024.
The judge wrote that California’s privacy agency has not yet finalized regulations in the areas of cybersecurity audits, risk assessments and automated decision-making technology. Enforcement in these areas will have to wait until one year after the regulations are finalized under the judge’s ruling.
Reaction to ruling
Jennifer Barrera, president and CEO of the California Chamber of Commerce, said the court’s ruling would be helpful for businesses seeking certainty and fairness in complying with “the complicated mandates called for in Proposition 24.”
She also praised the court for “recognizing that it would be unfair for the CPPA to enforce new regulations when the impacted businesses did not even know what was going to be required of them.”
The defendant in the case filed by the chamber is the California Privacy Protection Agency or CPPA.
Ashkan Soltani, the agency’s executive director, said CPPA was pleased the court “held that significant portions of Prop 24’s privacy protections remain enforceable starting tomorrow.”
“Although we’re disappointed the court granted the Chamber’s request to delay enforcement of portions of the regulations enacted earlier this year, the Agency remains committed to advancing the privacy rights of Californians and will take the appropriate next steps to safeguard the protections Californians overwhelmingly supported at the ballot box,” Soltani said in a prepared statement.
