June 13, 2021

Volume XI, Number 164


June 11, 2021

Subscribe to Latest Legal News and Analysis

One More Year: Attorney General Issues Final Regulations as CA Legislature Delays Some Compliance Obligations

Qualifying businesses have another year to complying with certain, major provisions of the CCPA. The CCPA, or the California Consumer Privacy Act of 2018, is a California law that gives California consumers, defined broadly to encompass all California residents, certain rights with respect to their personal information. Namely, it gives consumers the right to know about the personal information that businesses collect about them; the right to know what businesses do with that information; and, the right opt out of the sale of certain personal information if a business sells that personal information. In turn, qualifying businesses that do business in California must institute certain policies, practices, and methods that allow consumers to effectuate those rights.

CCPA Then and Now: The Road to a “Final” Version

The CCPA was signed into law on June 28, 2018, became operative on January 1, 2020, and called for the Attorney General to promulgate implementing regulations before July 1, 2020. Due in part because the Attorney General had nearly two years to promulgate implementing regulations, the scope of businesses’ obligations under the law has been in flux pending the finalization of the regulations.

Since the CCPA was first signed in law, it has undergone many changes, significantly affecting its impact. In September 2018, just two months after the CCPA was signed, the California Legislature passed amendments that significantly changed its scope and how it would be enforced. (Read more about those amendments here). The following year, on October 10, 2019, the California Legislature passed additional amendments that further changed the scope of the CCPA. (Read about those amendments here). Part of those amendments was a bill that, with respect to information used in Business to Business (“B2B”) transactions and employee information used for employment purposes, delayed businesses’ obligations to comply with most of the CCPA until January 1, 2021. Then, throughout late 2019 and early 2020, the Attorney General released iterations of proposed implementing regulations, for public comment. Those regulations became finalized on August 14, 2020.The final text of the regulations can be found here.

But Wait, There’s More!

Due to the uncertain scope of business obligations and additional strain caused by the COVID-19 pandemic, businesses and trade groups sought to delay the Attorney General’s enforcement of the Act. Although the Attorney General did not agree to delay enforcement, he stated that his office may “exercise prosecutorial discretion if warranted.”

The CA Legislature, however, was persuaded by the businesses and groups, at least in part, and delayed compliance requirements for certain provisions of the CCPA. On September 1, 2020, the CA Legislature passed a bill extending the delay of business obligations with respect to certain personal information used in B2B transactions and for certain employment purposes until January 1, 2022. Businesses will still need to comply with the CCPA’s notice-at-the-time-of-collection requirement and are still subject to the CCPA’s data breach provision, which gives consumers the statutory right to bring legal actions against businesses for certain data breaches. But, business can rest easier knowing that at least some of the burden of compliance is delayed for another year. The full text of that bill is available here.

© 2021 Proskauer Rose LLP. National Law Review, Volume X, Number 259



About this Author

Ryan Blaney Privacy Law Attorney Proskauer Law Firm

Ryan Blaney has particular expertise in privacy law, and represents health care, life science, and technology clients in a range of regulatory, enforcement, internal investigative and transactional matters. Blaney also practices life sciences and digital health law and has expertise in regulatory compliance, counseling clients on a range of matters, including health care fraud and abuse, third party reimbursement, data breach issues, data privacy and security, and FDA regulatory matters. He has substantial experience in pharmaceutical lifecycle management and competition issues, including...

Christina Hyun Jin Kroll Litigation Lawyer Proskauer Law Firm

Christina Kroll is an associate in the Litigation Department. Christina earned her J.D. from the University of California, Los Angeles, where she was the deputy chief articles editor of the Journal of International Law and Foreign Affairs. During law school, Christina served as a judicial extern to the Honorable Alex Kozinski of the United States Court of Appeals for the Ninth Circuit.