California Proposes New Regulations To Implement CCPA Rewrite

California Privacy Protection Agency moves ahead with CPRA rulemaking that might be mooted by bipartisan agreement on U.S. data privacy legislation.

The California Privacy Protection Agency (Agency) keeps working on implementing the California Privacy Rights Act (Proposition 24) (see here for more detail and analysis) that voters elected to amend the California Consumer Privacy Act (CCPA) (AB 375). The Agency has proposed regulations the CPRA mandates that will amend the operative CCPA regulations through a significant tightening of requirements on businesses. As you might recall, this is but the latest rulemaking California has undertaken (see here and here.) Of course, there is always the risk that Congress passes the “American Data Privacy and Protection Act” (ADPPA) (see here for more detail and analysis) or something like it to preempt all state privacy laws and all this work is for naught.

In late May, rulemaking authority was transferred from the California Attorney General to the Agency per the CPRA. This followed the California Office of Administrative Law (OAL) “approving the transfer of the existing CCPA regulations to Title 11, Division 6, a new division of the California Code of Regulations that is under the jurisdiction of the Agency.” The Agency explained that it “began preliminary rulemaking last year, when it collected hundreds of pages of written pre-rulemaking comments from the public…[and] held two days of pre-rulemaking Informational Sessions.” In early May, the Agency “welcomed comments from the public over three days of pre-rulemaking Stakeholder Sessions.”

In the Initial Statement of Reasons, Agency noted the CPRA requires it “to adopt regulations to further the purposes of the Act, including promulgating regulations on 22 specific topics.” The agency asserted “[t]he proposed regulations operationalize the CPRA amendments to the CCPA and provide clarity and specificity to implement the law.” The Agency added that “[b]uilding off of the existing CCPA regulations, the proposed regulations provide comprehensive guidance to consumers, businesses, service providers, and third parties, on how to implement and operationalize new consumer privacy rights and other changes to the law introduced by the CPRA amendments to the CCPA.”