The state’s attorney general issued final proposed regulations for expedited review, but it remains unclear whether before the enforcement period begins.
6/20/2020 9:00
California Attorney General Xavier Becerra on June 30 issued an alert reminding consumers of plans to begin enforcement of the California Consumer Privacy Act (CCPA) starting July 1, 2020.
Businesses subject to CCPA were required to begin complying with the law on Jan. 1, 2020. Proposed final regulations under the CCPA were submitted to the California Office of Administrative Law on June 1, 2020 and are currently pending approval, according to the alert.
The proposed regulations were released a month in advance of the anticipated July 1 enforcement date, ACA International previously reported.
“The regulations will provide guidance to businesses on how to comply with the CCPA and will enable consumers to exercise new rights over their personal information. Under Executive Order N-40-20 related to the COVID-19 pandemic, OAL has 30 working days and an additional 60 calendar days to determine whether the regulations satisfy the procedural requirements of the Administrative Procedure Act. Once approved by the OAL, the regulation text will be filed with the Secretary of State and become enforceable by law,” according to a June 2 news release from the attorney general’s office.
The attorney general is asking for expedited review of the regulations before the July 1 enforcement date, but according to a blog post from ACA International member firm Troutman Sanders LLP, the timing is not necessarily feasible.
“Normally, for the CCPA regulations to be effective by the originally-anticipated July 1 enforcement date, AG Becerra should have submitted the proposed regulations to the OAL, and filed the approved rules with the Secretary of State no later than May 31, 2020,” the blog post states.
If the CCPA regulations were to be finalized by May 31, they would take effect on July 1. If, however, if the regulations are finalized between June 1 and Aug. 31, then the regulations take effect on Oct. 1, three months after CCPA’s enforcement start-date. Those dates rely on typical rulemaking process information published by OAL and assume that the OAL would not be subject to an expedited 30-day window to review the CAG’s final regulations, as the AG’s office has requested.
Text of the CCPA and changes from the prior version of the proposed regulations can be viewed on the California Attorney General’s website for the CCPA.
The final proposed regulations reflect no substantive changes from the second modified proposed regulations, released in March.
As a refresher, key requirements of the CCPA, according to the attorney general, include:
- Businesses must disclose data collection and sharing practices to consumers;
- Consumers have a right to request that their data be deleted, although there are exceptions that should apply to the collections industry;
- Consumers have a right to request what information is collected; and
- Businesses are required to provide a privacy notice prior to collecting information from a consumer.
Related Content from ACA International
California Issues More Modifications to CCPA Data Privacy Law
Mapping the California Consumer Privacy Act
If you are interested in sharing articles and analysis on legal cases, industry laws and regulations or other relevant topics for possible publication with ACA International, email our Communications Department at [email protected].