By: Linda L. Goodman
As you may recall, the California Consumer Privacy Act (“CCPA”) requires the California Attorney General (“Attorney General”) to adopt initial regulations (which is the guide to interpreting the California Consumer Privacy Act (“CCPA”)) by July 1, 2020. The process to adopt a regulation is rather complicated in California. It requires the Attorney General to submit the regulations to the California Office of Administrative Law (“OAL”) who can take up to 90 days to review for conflicts, constitutionality, and clarity amongst other things. OAL may recommend changes, add text, or issue a final approval. This approval is required before the Attorney General can adopt or bring enforcement actions for violation of the regulations.
The Attorney General delayed submission of the final regulations and final “Statement of Reasons” (explanations of the Attorney Generals understanding of the regulations) to the OAL until June 1, 2020. If it is true to its 90-day review period, the regulations cannot be adopted timely. Because they have not been adopted, the Attorney General cannot enforce actions for violations of the regulations. Thus, explains why the Attorney General has requested priority over the other 90+ proposed regulations current before the OAL. There is no guarantee of approval by July 1, 2020, but that has not stopped the Attorney General from announcing enforcement of the CCPA will begin on July 1, 2020, despite numerous requests from the industry for a delay.
Several industry leaders submitted comment letters during the comment period after the Second Set of Modified Regulations were released asking the Attorney General to delay the implementation of the regulations so that companies could have time to implement the new regulations. The Attorney General declined those requests.
Any company that has delayed their compliance programs awaiting final regulations for clarity of the uncertainty presented by both the law and the regulations should now move to complete their compliance programs. As it is a near certainty that the final Regulations published by the Attorney General will be accepted and adopted by the OAL, companies should utilize those regulations for compliance procedures and policies. You have less than one month to come into compliance.
NEXT UP – CALIFORNIA PRIVACY RIGHTS ACT – CCPA ON STEROIDS
As you may recall, the CCPA was written and passed on the promise by an activist group to rescind a ballot initiative promoted by Californians for Consumer Privacy. Upon passage, the initiative was removed from the ballot. Before the ink dried, the same group collected sufficient signatures to once again place a ballot initiative “California Privacy Rights Act” in November. California election officials must still validate the signatures by June 25th in order for the CPRA to make the ballot this year. Should it make the cut, it appears to have sufficient support to overwhelmingly pass, which would mean that it would likely go into law on January 1, 2023.
The CPRA’s requirements would go well beyond those of the CCPA in many respects. For example, it creates additional obligations for companies that process “sensitive” personal information and demands additional rights, such as the right to correct inaccurate personal information. More importantly, the CPRA creates another bureaucracy, “California Privacy Protection Agency,” which would be responsible for enforcing the law, displacing the California AG’s office in that role. Thus, companies could expect multiple cross-over enforcement claims.
______________________________________________________________________
This article is a publication of The Goodman Law Firm and is intended to provide information on recent legal developments. This article does not create an attorney-client relationship, nor should it be construed as legal advice or an opinion on specific situations. This may constitute “Attorney Advertising” under the Rules of Professional Conduct and under the law of other jurisdictions.
Linda L. Goodman is the founder of The Goodman Law Firm, concentrating its practice in internet business and law. Her firm’s clients include Advertisers, Affiliates, Affiliate Networks, and ISP’s.
© 2020 TGLF, A.P.C.