The CCPA Enforcement is Here While the Regulations Are Still under Review

 On July 1, 2020, the California Attorney General has begun enforcement of the California Consumer Privacy Act which became effective on January 1.  In a statement published on the Attorney General’s website, he declared that “[t]oday we begin enforcement of the [CCPA], a first-of-its-kind data privacy law in America.  We encourage every Californian to know their rights to internet privacy and every business to know its responsibilities. The website of every business covered by the law must now post a link on its homepage that says ‘Do Not Sell My Personal Information’. Click on it. Remember, it’s your data. You now get to control how it’s used or sold.”

Earlier, the Attorney General outlined the following enforcement priorities for the CCPA:

• The Attorney General promised aggressive, early, and decisive enforcement actions but will initially prioritize provisions that require companies to obtain parental consent to sell personal information of children under the age of 13 and opt-in consent of children between the ages of 13 and 16.

• The Attorney General promised to be “patient” with small businesses that are making a real effort to comply with the CCPA but indicated that ignorance of the regulatory obligations would not be an excuse.

• The Attorney General promised to monitor for potential violations in the first six months of the Act that involved sensitive and critical data of a large number of California residents. The CCPA does not prohibit the Attorney General from brining an enforcement action after July 1 based on the pre-July 1 violation.

Notably, the enforcement begins as the final CCPA Regulations are still under review by the State’s Office of Administrative Law (OAL) and therefore have no legal force.  The Attorney General submitted the final Regulations for the OAL’s review on June 1, 2020.  The OAL had 30 working days, plus an additional 60 calendar days under the Executive Order N-40-20 related to the COVID-19 pandemic, to review the Regulations for procedural compliance with the Administrative Procedure Act.

In the Written Justification for Earlier Effective Date and Request for Expedited Review, the Attorney General requested the OAL to conduct an expedited review and that the Regulations become effective upon the filing with the Secretary of State.  Specifically, the Attorney General requested that the OAL complete its review within 30 business days, given the CCPA’s mandate for the “Attorney General [to] adopt initial regulations by July 1, 2020.”

As of July 1, however, it appears that the OAL has not completed its review and it is unclear whether it even conducts it on the expedited basis.  Based on the standard administrative procedures, absent expedited review, the Regulations would likely not come into force until October 1, 2020.

Ask Clarip today how we can solve your biggest privacy compliance pain points, Call Clarip at 1-888-252-5653