Written Comments Due by August 23
On July 8, 2022, the California Privacy Protection Agency (CPPA) began the formal rulemaking process to adopt proposed regulations implementing the amendments made by the California Privacy Rights Act (CPRA) to the California Consumer Privacy Act (CCPA). The CPPA's filing of the Notice of Proposed Rulemaking starts a 45-day public comment period that ends on August 23, 2022.
The proposed regulations make non-substantive edits to an earlier version that the CPPA initially published on May 27, 2022. As we previously discussed in our client alert and in-depth Data Advisor article analyzing the initial package of draft regulations, the proposed regulations still cover only some of the 22 rulemaking topics identified in the CPPA's September invitation for preliminary comments. Please check out our webinar series for more information regarding the proposed regulations; a recording of the first webinar in our series is now available.
Alongside the draft regulations, the CPPA also published an Economic Impact Statement as well as the Initial Statement of Reasons, which aims to provide justification for the requirements.
Next Steps
The proposed regulations are subject to a mandatory 45-day public comment period, after which the CPPA will hold public hearings on August 24 and 25, 2022. Interested members of the public may attend in person or online, and individuals who wish to speak are requested to RSVP.
The CPPA will accept written comments until 5:00 p.m. PDT on August 23, 2022. Comments may be submitted by the following means:
Electronic:
Comments may be submitted electronically to regulations@cppa.ca.gov. Please include "CPPA Public Comment" in the subject line.
Mail:
California Privacy Protection Agency
Attn: Brian Soublet
2101 Arena Blvd., Sacramento, CA 95834
(279) 895-6083
After the 45-day comment period, the CPPA either will adopt the regulations substantially as described in the Notice of Proposed Rulemaking or make modifications based on the comments. If the CPPA decides to make "major" modifications to the originally proposed text, another 45-day comment period will commence. However, if the modifications are only "substantial and sufficiently related," the CPPA will initiate a 15-day comment period. During the California Attorney General's original rulemaking activities for the CCPA in 2019 and 2020, the draft regulations went through one 45-day comment period and two 15-day comment periods, and the entire rulemaking process took just over 300 days between the issuance of the Notice of Proposed Rulemaking and the final text of the regulations.
We encourage businesses affected by the CPRA proposed regulations to submit comments to the CPPA. Wilson Sonsini Goodrich & Rosati routinely helps companies navigate complex privacy and data security issues and will monitor CPPA guidance, enforcement, and litigation pursuant to the CPRA to assist clients with compliance. For more information or advice concerning your CPRA compliance efforts, please contact Tracy Shapiro, Maneesha Mithal, Eddie Holman, Amanda Irwin, Clinton Oxford, or any member of the firm's privacy and cybersecurity practice.
