May 26, 2022

Volume XII, Number 146


May 25, 2022

Subscribe to Latest Legal News and Analysis

May 24, 2022

Subscribe to Latest Legal News and Analysis

May 23, 2022

Subscribe to Latest Legal News and Analysis

California Privacy Protection Agency Holds Pre-Rulemaking Stakeholder Sessions

The California Privacy Protection Agency (CPPA) in charge of implementing and enforcing the California Privacy Rights Act (CPRA) and California Consumer Privacy Act (CCPA) held a series of pre-rulemaking stakeholder sessions over three days last week. Executive Director of the Agency, Ashkan Soltani, opened the sessions on Wednesday, May 4, welcoming those in attendance which included Professor Jennifer Urban, Chair of the Agency. Urban was appointed Chair of the five-person CPPA Board by California Governor Gavin Newsom in March 2021.  

These stakeholder sessions were the third of the Agency’s pre-rulemaking activities. The first activity was an invitation for written comment. The second was a set of pre-rulemaking informational sessions. Speakers for the informational sessions included academics who study relevant topics and officials from the Office of the California Attorney General, the CPPA and the European Data Protection Board.

For this third pre-rulemaking activity, Agency staff and its Board were in “listening mode” as a variety of interested individuals provided verbal comments and suggestions regarding implementing and improving the laws. Commenters included businesses with experience implementing the CCPA, consumers who have exercised their rights under the law, public policy groups and several industry associations.

  • Automotive industry stakeholders raised the need for limits to consumers’ ability to opt out of personal data collected by their vehicle, citing vehicle system safety concerns. They questioned whether a consumer’s right to correct data generated by vehicle components and sensors could be effectively exercised and proposed limiting data that can be corrected to personal data provided by the consumer directly to the business.

  • Businesses acknowledged their desire to comply with the CCPA, while at the same time expressed frustration with the time and cost involved in implementing provisions of the law that seem likely to change.

  • Stakeholders raised concerns around the broad definition of “sale” under the CCPA and CPRA, as well as the need for further guidance on how the Agency and CA Attorney General intend to enforce provisions related to the sale of personal data.

The California Privacy Protection Agency has full administrative power, authority and jurisdiction to implement and enforce the CPRA and California Consumer Privacy Act. The Agency has the power to bring enforcement actions of these laws before an administrative judge, while the California Attorney General holds civil enforcement authority over the laws. This agency is the first in the country dedicated to the protection of data privacy rights.

Agendas, materials and recordings of Agency pre-rulemaking activities can be found here.

© 2022 Varnum LLPNational Law Review, Volume XII, Number 130

About this Author

Jeffrey M. Stefan II Auto and Emerging Technology Attorney Varnum Law Firm

Jeffrey is a technology-focused corporate attorney with broad legal authority in autonomous and connected vehicles. He previously served as autonomous vehicle counsel for a major global automaker providing regulatory counsel and transactional support. Prior to that role, he supported the automaker's emerging technology portfolio, which included connected vehicle services and other advanced safety technologies.

Jeffrey helps his clients navigate the evolving legal and public policy landscape for new and emerging technologies. He additionally focuses on technology startups assisting...

Andrea M. Gumushian Attorney Data Privacy Varnum Law DC California

Andrea is an associate on Varnum’s data privacy and mobility practice teams. She advises leading mobility and technology providers on domestic and international data privacy laws and regulations. Her practice includes drafting and reviewing data protection impact assessments, privacy policies and product-specific privacy notices. Andrea helps clients implement policies and procedures for responding to consumer rights requests and data breaches under the EU-GDPR and California Consumer Privacy Act. She also has experience reviewing vendor and customer contracts with a...