California Attorney General Will Not Extend the January 1, 2020 CCPA Deadline

The California Consumer Privacy Act (CCPA) will still take effect on January 1, 2020, as originally planned.   In a December 10 interview with Reuters, the California Attorney General Xavier Becerra declared that he is not planning an extension of the January 1 deadline.  The Attorney General also indicated how his office will approach the CCPA enforcement after the July 1, 2020 enforcement deadline: “We will look kindly . . . on those that … demonstrate an effort to comply . . . If they are not (operating properly) … I will descend on them and make an example of them, to show that if you don’t do it the right way, this is what is going to happen to you.”

This announcement follows a conclusion of the public comment process, including four days of public hearings, on the proposed CCPA Regulations where some commentators requested an extension of the effective date given the absence of the final regulations and lack of clarity on some of the CCPA aspects.

Last week, we discussed the issues raised at the first public comment hearing in Sacramento on December 2.  According to the published reports, the following issues were raised at the subsequent hearings in Los Angeles and San Francisco:

• Businesses that collect personal information through indirect means raised concerns over the ways of providing the required notices to consumers prior to sale of their information as envisioned by the proposed Regulations, e. by contacting consumers directly or obtaining signed attestations that notices were provided from the original sources of personal information. Speakers at the Los Angeles hearing proposed that the Attorney General revise regulations to permit businesses that collect consumers’ personal information from other sources to post “notices at collection” on their websites.

• The CCPA applies to businesses that annually buy, receive, sell, or share the personal information of 50,000, or more, consumers, households, or devices. Speakers at the Los Angeles hearing raised concerns over the applicability of the Act to small business that collect over 50,000 IP addresses through their website visits but might have far fewer than 50,000 customers.

• Speaker at the Los Angeles hearing raised concerns about lack of clarity as to whether the CCPA applies to unions which qualify as non-profits (and therefore presumably are excluded from the CCPA) but are also organized and operated for the profit of their members (which might suggest that they fall within the scope of the CCPA).

• Speakers at the Los Angeles and San Francisco hearings expressed concerns over proposed regulations which require a business notified of consumer’s opt-out request to notify third parties to which the business sold personal information within 90 days prior to the receipt of the request and to instruct them not to sell personal information. The speakers pointed out that the proposed provision is burdensome, does not appear in the original Act, and could force businesses to breach existing contracts with data re-sellers.

• Multiple speakers expressed concern that although the proposed Regulations envision businesses utilizing an opt-out button/logo, the design of the logo is yet to be provided in the future version of the Regulations.

• Numerous speakers also commented on the proposed regulations related to financial incentives and expressed concerns over the proposed provisions requiring businesses offering different prices based on consumers’ exercise of their rights under the CCPA to assess and disclose the value of the consumers’ data.

We’ll continue to follow and analyze the developments in the CCPA regulatory process.  The Attorney General is expected to issues a final version of the CCPA Regulations sometime before the enforcement deadline of July 1, 2020.

Ask Clarip today how we can solve your biggest compliance pain points, Call Clarip at 1-888-252-5653