The world is on lockdown (and fire), but the march toward enforcement of the California Consumer Privacy Act (CCPA) is proceeding apace.
On Monday, the California attorney general’s office submitted the final proposed implementation regulations for the CCPA to the California Office of Administrative Law (OAL).
There appear to be no major changes made between this version and the previous one released in February. Click here to read the full text.
“All the regulations match broadly with the expected drafting and recent guidance,” said Cillian Kieran, CEO of privacy compliance startup Ethyca. “But given the pandemic, not only are businesses struggling with the current economic pressure of a major pandemic, they have to comply with a far-reaching set of business process-changing regulations.”
Businesses are required to provide a clear notice at or before the point of collection of personal information. Consumers have the right to know about and delete any personal information that is collected, disclosed or sold. And businesses have to honor the consumer’s right to opt out of the sale of personal information.
The OAL now has 30 working days to review the regs (plus an additional 60 calendar days under an executive order related to the COVID-19 pandemic). That’s 90 days total – and CCPA enforcement is still slated to begin on July 1.
When the regs are finally approved, they’ll be filed with the California secretary of state and become enforceable by law.
Although it’s possible that the OAL will give its thumbs up on the regs just in time for the July 1 enforcement date, the OAL is probably dealing with a pandemic-induced backlog. That means the CCPA could be enforced while the regs are still in flux.
The purpose of the implementation regs is to provide businesses with practical information they can use to operationalize the law.
Ad trade organizations, including the Association of National Advertisers (ANA), have complained that the AG isn’t giving businesses enough time to implement the new regs. The ANA and others appealed to California Attorney General Xavier Becerra in March to hold off enforcing the law until January 2021 because of disruptions due to COVID-19, but to no avail.
For what it’s worth, the AG’s office has formally requested that the OAL expedite its review of the regs.
It’s been a long road to get here.
October 2019: The AG’s office publishes the highly anticipated first draft of its CCPA implementation regs.
December 2019: Comments are due on draft numero uno.
February 2020: The AG releases the second version in early February, taking feedback into consideration. Comments on draft two are due later in the month.
March 2020: Ad trade orgs ask for – and are denied – an extension on enforcement.
June 1, 2020: The AG finally submits its regs to the OAL (essentially version No. 3) for approval.
July 1, 2020: CCPA enforcement, here we come.
