5 Months to CCPA Compliance

The calendar hit August 1st today which means there is only five months left until the California Consumer Privacy Act (CCPA) goes into effect on January 1, 2020. We were remarking yesterday in the office about how quickly the last year has passed in the privacy world.

The next five months are ramping up to be very busy as well:

This month is going to be the time where the debate over the changes to the CCPA take place in the legislature. The CA Senate Appropriations Committee will consider the CCPA amendments on Monday, August 12th. This was where SB561, the private right of action proposed by the California Attorney General and introduced by Senator Jackson died earlier in the year. The bills that proceed through the fiscal committee will then proceed to a vote on the floor of the Senate.

If the passed bill has not changed since it was adopted by the Assembly, then it will go the Governor for signature. Otherwise, it will begin the reconciliation process to either be passed by the Assembly as amended or a compromise text proposed to be passed by both bodies of the legislature. The deadline for each house to pass bills to be sent to the Governor is September 13th.

As soon as the legislative process is over, the watch for the draft CA Attorney General regulations will be on. In the spring, the AG’s Office indicated that they anticipate publishing the Notice of Proposed Regulatory Action, which will contain the draft text for the regulations, in Fall 2019. The publication of the notice will kick start a 45-day public comment period and an intense debate to influence the final regulations by impacted businesses.

Organizations will also be putting in place their changes for Nevada. Nevada’s opt-out privacy law contained in Senate Bill 220 that was signed into law by the Nevada Governor in May will go into effect on October 1, 2019.

By the time November rolls around, it will be a scramble for businesses to finalize their CCPA rollout ahead of the holiday period. There will be some leeway with the actual CCPA enforcement by the Attorney General delayed a few months by SB1121 last year. Nevertheless, the private right of action will go in effect on January 1st. The final regulations from the AG will also probably be published around that time (depending on the extensiveness of changes made to the initial draft following the public comment period) and could call for additional changes by companies with their CCPA compliance program.

Next year seems unlikely to grant a reprieve for privacy and compliance professionals, as privacy laws will be back on the legislative agenda of New York, Washington and other states. By the time enforcement of the CCPA begins, there very well could be 1-4 new state privacy laws. There is also the possibility of a new federal privacy law from Congress, though the odds of a consensus developing between the two parties during an election year seem low.