On June 30, 2023, a Superior Court for the County of Sacramento issued a tentative ruling that both prohibits the California Privacy Protection Agency (CPPA) from enforcing certain California Privacy Rights Act (CPRA) regulations until 2024 and mandates a 12-month grace period between the adoption of future CPRA regulations and their regulatory enforcement. Accordingly, the original California Consumer Privacy Act of 2018 (CCPA) remains in effect until the CPRA regulations enter into force in 2024.
Background
In 2018, California enacted the CCPA, which provides California residents with various data privacy rights and privileges regarding the collection and use of their personal data. The CCPA became operative on January 1, 2020.
In November 2020, California voters approved Proposition 24, also known as the California Privacy Rights Act of 2020 or CPRA. The CPRA established new standards regarding the collection, retention, and use of consumer data and created the CPPA to implement and enforce the law.
The CPRA provides both that “[t]he timeline for adopting final [CPRA] regulations . . . shall be July 1, 2022” and CPRA enforcement “shall not commence until July 1, 2023, and shall apply to violations occurring on or after that date.”
However, California missed its deadline to promulgate CPRA regulations by almost nine months. It was not until March 29, 2023, that the CPPA finalized its first set of regulations under the CPRA, and these regulations only addressed 12 of the 15 areas identified in the law that would require implementing regulations (e.g., requirements governing privacy notices, data subject request processes, targeted advertising, and third-party contracting). The three areas in which California has not finalized its regulations concern cybersecurity audits, risk assessments, and automated decision-making technology.
Although the CPPA has publicly stated it will not be enforcing the three regulatory areas that have not been finalized, it intends to enforce the other 12 areas of the CPRA regulations as soon as July 1, 2023.
Litigation and Holding
On March 30, 2023, the California Chamber of Commerce (the Chamber), which represents itself as the largest broad-based business advocacy group in California, sought to enjoin the CPPA from bringing any enforcement actions under the new CPRA regulations until the 12-month “grace period” inferred within the law is satisfied, and a Superior Court for the County of Sacramento agreed.
In short, the Court found that the CPRA’s plain language indicates the CPPA was required to have final regulations in place by July 1, 2022, and allows it to begin enforcement a year later on July 1, 2023. “The very inclusion of these dates,” according to the Court, “indicates the voters intended there to be a gap between the passing of final regulations and enforcement of those regulations.” Accordingly, the Court agreed with the Chamber’s argument that this delay intended “to allow sufficient time for affected businesses to become compliant with the [CPRA] regulations.”
In conclusion, the Court prohibits the CPPA’s enforcement of any CPRA regulation for 12 months after that individual regulation is implemented. This means that the CPRA regulations finalized on March 29, 2023, will not become effective until March 29, 2024.
Accordingly, based on the plain language of the CPRA, the CCPA remains in effect and is enforceable against businesses until the CPRA regulations enter into force in 2024.
