More CCPA Uncertainty? The CCPA Regulations May Potentially Be Delayed until October 1, 2020

The International Association of Privacy Professionals reported that the California Consumer Privacy Act (CCPA) Regulations may be delayed until after July 1, 2020.

The Act, which came into effect on January 1, 2020, prescribes that “on or before July 1, 2020, the Attorney General shall . . . adopt regulations to further the purpose of [the CCPA].”  Before the proposed regulations take effect, however, they must be submitted for review to the State Office of Administrative Law (OAL).  OAL has 30 working days to conduct a review of the rulemaking record to ensure that the agency satisfied the requirements of the California Administrative Procedures Act and the OAL’s regulations.  OAL will then either approve the rulemaking action and file the proposed regulation with the Secretary of State or disapprove the action.

Generally, California regulations become effective on one of four quarterly dates based on when the final regulations are filed with the Secretary of State.  To become effective on July 1, 2020, the CCPA Regulations must be filed with the Secretary of State no later than May 31, 2020.  If the Regulations are field sometime between June 1 and August 31, their effect date will be pushed back to October 1, 2020.

The Attorney General published the first draft of the proposed CCPA regulations on October 11, 2019.  On March 11, 2020, the Attorney General released the second set of modifications to the proposed regulations, the latest draft to date.  The public comment period on that draft concluded on March 27.  As of May 22, 2020, however, the CCPA regulations have not been listed among the regulations submitted to the OAL for review.  The IAPP notes that although it is possible for the Attorney General to seek emergency review, it would be unlikely with only a few days left before the May 31 filing deadline and the large backlog of the regulations to be reviewed by the OAL.

The CCPA mandates that the Attorney General may not bring enforcement actions under the Act before July 1, 2020.  Although numerous trade groups have urged a delay in light of the COVID-19 pandemic, the Attorney General has indicated that he will not delay the enforcement past the July 1 deadline.  Accordingly, companies doing business in California may soon find themselves in an uncomfortable position where they may be subject to the CCPA enforcement action in the absence of the final CCPA regulations.

Ask Clarip today how we can solve your biggest privacy compliance pain points, Call Clarip at 1-888-252-5653