iOn Friday the California Privacy Protection Agency which enforces the California Consumer Privacy Act (CCPA) received a win when the CA Third District Court of Appeals sided with them and the state’s AG after the Chamber of Commerce had previously won a partial writ of mandate challenging the enforcement date of the amendments passed by voters with the adoption of Proposition 24 (CPRA). Friday’s decision restores the agency’s authority not only to enforce the amendments that were put in place with the passing of CPRA but the CCPA as a whole.
Backing up a bit here, CCPA came to pass in 2018 and became effective on January 1, 2020. CCPA was an act that provided Californians privacy rights over their personal information that was being collected, used, and disclosed by businesses that meet the requirements. In November 2020 Proposition 24 (CPRA) was approved by voters and would become effective January 1, 2023. The CPRA was an amendment to further expand consumer privacy rights under the CCPA including the sale of personal information and added regulations around the use and disclosure of sensitive personal information (SPI).
When CPRA was passed it established the California Privacy Protection Agency which is charged with enforcing the CCPA. The agency was tasked to adopt, amend, and residence regulations to carry out the CCPA and finalize regulations for 15 new parts by July 1, 2022. The agency missed the July 1st deadline and instead published a notice of proposed rulemaking concerning the act on July 8, 2022, describing their intention to amend several regulations and repeal one. On March 29, 2023, the Office of Administrative Law approved the agency’s final regulation proposal which addressed 12 of the 15 new parts of the act.
This is when the Chamber of Commerce filed a petition for writ of mandate and complaint for injunctive and declaratory relief. The Chamber was seeking an order against the agency to complete the final three parts of the new section to have complete regulations outlined for all 15 new areas and pushing the enforcement deadline one year from the time once all new parts were complete. While the trial court dismissed the injunctive and declaratory relief, it granted the writ petition. The court did agree that the enforcement timeline should be pushed back, but it did not agree with the suggested date the Chamber provided and rather declared the agency could start enforcing regulations on March 29, 2024, one year after the Office of Administrative Law had approved final proposed regulations.
The Agency could enforce certain regulations under CCPA but was left unable to fully regulate the implementation of the CPRA while it awaited a ruling on a petition for extraordinary writ relief in the nature of mandamus. However, with Friday’s ruling, the agency is now back in full force and able to enforce all the regulations under the CCPA including the amendments brought by the CPRA.
Now would be a great time to check and re-check your Privacy Policies and ensure you are complying with all state laws when it comes to consumer data privacy.
