The state’s attorney general issued final proposed regulations for expedited review, but it remains unclear whether they will be in effect before the enforcement period begins.
6/5/2020 12:30
California Attorney General Xavier Becerra submitted proposed regulations under the California Consumer Privacy Act (CCPA) to the California Office of Administrative Law (OAL) on June 1, according to a news release from the attorney general’s office.
The proposed regulations were released a month in advance of the anticipated July 1 enforcement date.
“The regulations will provide guidance to businesses on how to comply with the CCPA and will enable consumers to exercise new rights over their personal information. Under Executive Order N-40-20 related to the COVID-19 pandemic, OAL has 30 working days and an additional 60 calendar days to determine whether the regulations satisfy the procedural requirements of the Administrative Procedure Act. Once approved by the OAL, the regulation text will be filed with the Secretary of State and become enforceable by law,” according to the news release.
The attorney general is asking for expedited review of the regulations before the July 1 enforcement date, but according to a blog post from ACA International member firm Troutman Sanders LLP, the timing is not necessarily feasible.
“Normally, for the CCPA regulations to be effective by the originally-anticipated July 1 enforcement date, AG Becerra should have submitted the proposed regulations to the OAL, and filed the approved rules with the Secretary of State no later than May 31, 2020,” the blog post states.
If the CCPA regulations were to be finalized by May 31, they would take effect on July 1. If, however, if the regulations are finalized between June 1 and Aug. 31, then the regulations take effect on Oct. 1, three months after CCPA’s enforcement start-date. Those dates rely on typical rulemaking process information published by OAL and assume that the OAL would not be subject to an expedited 30-day window to review the CAG’s final regulations, as the AG’s office has requested.
Text of the CCPA and changes from the prior version of the proposed regulations can be viewed on the California Attorney General’s website for the CCPA.
The final proposed regulations reflect no substantive changes from the second modified proposed regulations, which were released in March.
As a refresher, key requirements of the CCPA, according to the attorney general, include:
- Businesses must disclose data collection and sharing practices to consumers;
- Consumers have a right to request that their data be deleted, although there are exceptions that should apply to the collections industry;
- Consumers have a right to request what information is collected; and
- Businesses are required to provide a privacy notice prior to collecting information from a consumer.
Related Content from ACA International
California Issues More Modifications to CCPA Data Privacy Law
Mapping the California Consumer Privacy Act
If you are interested in sharing articles and analysis on legal cases, industry laws and regulations or other relevant topics for possible publication with ACA International, email our Communications Department at [email protected].