On March 11, 2020, the California Attorney General issued further revisions to the proposed regulations implementing the California Consumer Privacy Act (CCPA).
For context, in passing the CCPA, the legislature directed the California Attorney General to solicit broad public participation and adopt regulations to further the purposes of the CCPA. On October 11, 2019, the California Attorney General issued the first draft of the proposed regulations, imposing obligations on businesses that arguably exceeded the statutory requirements of the CCPA, which were noticed for a 45-day public comment period. On February 10, 2020, after the CCPA had gone into effect and after receiving nearly 1,700 pages of written comments and additional oral comments, the California Attorney General issued a second draft of the proposed regulations, scaling back some of these obligations and adding some helpful clarification. During the subsequent 15-day written public comment period on these proposed changes, approximately 100 written comments spanning 782 pages were submitted.
While this latest version of the proposed regulations is still not final and is subject to another public comment period, some of the changes that are most likely to affect CCPA compliance efforts, ranked from least to most helpful for businesses, include:
The proposed regulations are now in their third public comment period, ending on March 27, 2020, at 5:00 p.m. PST. Given that the California Office of Administrative Law must review and approve the California Attorney General's rulemaking file before the regulations can be finalized, which must happen by July 1, 2020, this version of the regulations is likely close to final. Accordingly, and as the California Attorney General can begin enforcing the CCPA on July 1, 2020, businesses should implement or update policies and procedures designed to comply with the CCPA and its implementing regulations as soon as possible.
For more information, advice concerning your CCPA compliance efforts, or assistance preparing or submitting a public comment to the California Attorney General, please contact Eddie Holman or another member of the firm's privacy and cybersecurity practice.