California Takes a Major Step Towards Establishing Its Privacy Regulator

On March 17, 2021, California officials announced appointments to the California Privacy Protection Agency (CPPA) Board.

The CPPA will be the first dedicated privacy agency in the United States.  The agency will be governed by a 5-member board comprised of privacy, technology, and consumer rights experts serving 8-year terms.  Jennifer Urban, Professor of Law at Berkeley has been appointed the Chair of the Board by the California Governor.  The remaining Board members were appointed by the Governor, Attorney General, Senate Rules Committee, and the Speaker of the Assembly.

The Agency will have full administrative power, authority, and jurisdiction to implement and enforce the California Consumer Privacy Act (CCPA), as amended by the newly passed California Privacy Rights Act (CPRA).

The CPPA’s responsibilities will include administering, implementing, and enforcing the CCPA; adopting, amending, and rescinding the CCPA Regulations (currently the province of the Attorney General); protecting fundamental privacy rights of natural persons; promoting public awareness and understanding of the rights, risks, and responsibilities regarding collection, use, sale, and disclosure of personal information; providing guidance to consumers regarding their privacy rights; providing guidance to businesses regarding their duties and responsibilities under the privacy law; appointing a Chief Privacy Auditor to conduct audits of businesses; providing technical assistance and advice to the lawmakers regarding privacy-related legislation; and monitoring of technological developments related to protection of personal information.

The CPPA will be empowered to investigate possible violations of the CCPA, make probable cause determinations of its violations, institute administrative proceedings upon finding of probable cause, subpoena documents and witnesses, conduct evidentiary administrative hearings, issue cease and desist orders, order payment of administrative fines, and bring civil actions to enforce payment of administrative penalties.  Any CPPA decision related to a complaint against a business or a penalty will be subject to review by the state courts.

The Agency will assume the rulemaking authority from the Attorney General by July 1, 2021, and will have to issue final regulations required by the CPRA by July 1, 2022. The Agency will be able to bring CPRA enforcement actions beginning on July 1, 2023.

Take a tour of Clarip’s patented data privacy technology and learn how Clarip can help your enterprise comply with emerging state level data subject rights regulations. Call Clarip today at 1-888-252-5653 or schedule a Demo Online!