Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

On June 29, 2023, the Superior Court of California for the County of Sacramento (Court) issued a&nbsp;<a href="https://content.mlex.com/Attachments/2023-06-29_4745C8U6094V3K3O%2fCU_34-2023-80004106-CU-WM-GDS_10a66e19-7726-4167-bfca-5c1591881c5f8.pdf">tentative ruling</a>&nbsp;staying the California Privacy Protection Agency (Agency) from enforcing the&nbsp;<a href="https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&amp;part=4.&amp;lawCode=CIV&amp;title=1.81.5">California Consumer Privacy Act of 2018 (CCPA)</a>&nbsp;regulations until one year after the final enactment of any individual regulation.

core/paragraph

The Agency Was Required to Publish Final Regulations by July 1, 2022

The California Chamber of Commerce (Petitioner) argued that the California Privacy Rights Act of 2020 (CPRA) required the Agency to have published final regulations by July 1, 2022, per Cal. Civ. Code § 1798.185(d) (“the timeline for adopting final regulations … shall be July 1, 2022.”).

The Agency argued that the phrasing “timeline for adopting” in Cal. Civ. Code § 1798.185(d) is ambiguous, and the July 1, 2022 deadline is meaningless.

The Court agreed with Petitioner that the timeline for adopting final regulations required by the Act shall be July 1, 2022, and the term “shall” indicates command, and there is no contrary intent elsewhere in the Act’s text. Further, the Court indicated that the voters’ intent was not for the Agency to have unlimited time to ultimately pass the final regulations.

The Enforcement Should Begin One Year Following the Final Regulations

Secondly, Petitioner argued voters intended for enforcement to begin one year following the Agency’s issuance of final regulations to allow sufficient time for businesses to become compliant with the regulations. Therefore, the Agency should be prohibited from enforcing the Act on July 1, 2023, when it did not pass final regulations by the July 1, 2022 deadline.

The Agency argued that there is no evidence of the voters’ intent to allow for a 12-month window between the passing of final regulations and the commencement of the Agency’s enforcement. Moreover, the Agency noted on March 29, 2023, that it implemented final regulations in 12 of the 15 areas in accordance with Cal. Civ. Code § 1798.185(d). As to the three remaining areas (cybersecurity audits, risk assessments and automated decision-making technology), it conceded that those regulations will not be finalized prior to the July 1, 2023 enforcement date. Further, the Agency indicated that there is not a timeline by which it plans to finalize the regulations for these areas.

The Court was unpersuaded by the Agency’s position that it did not have to comply with the July 1, 2022 deadline for final regulations, but the July 1, 2023 enforcement date of the regulations would still apply. Ultimately, the Court agreed with Petitioner that the 12-month window for enforcement aligns with the voters’ intent. However, the Court did agree with the Agency that delaying their ability to enforce&nbsp;any&nbsp;violation of the Act until 12 months after all regulations have been implemented is not aligned with the voters’ intent. To find a balance between the two positions, the Court stayed the Agency’s enforcement of any individual regulation for one year after final implementation of the regulation.

The enforcement of any final regulations will be stayed for a period of 12 months from the date that the individual regulation becomes final. That means the&nbsp;<a href="https://cppa.ca.gov/meetings/materials/20230203_item4_text.pdf">final regulations</a>&nbsp;published on March 29, 2023, cannot be enforced by the Agency until March 29, 2024.

Although the ruling is effective immediately, the Court will hear oral arguments on June 30, 2023, to determine if it will change its ruling. We will follow this introductory post with a subsequent post following the hearing.

Tentative Ruling Issued to Delay Enforcement of CCPA Regulations Until March 29, 2024