The CPPA Draft Regulations Investigation and Enforcement Provisions
The California Privacy Protection Agency (CPPA) has published some draft regulations for the California Privacy Rights Act (CPRA). The CPPA’s state of progress is doubly incomplete. First, these are draft regulations, not the finished products. Second, the CPPA has only addressed some of the 22 necessary topics that they need to address, so they will still need to delve into additional topics.
The CPPA used the text in the California Code of Regulations as a starting point and have made some deletions as well as significant additions.
Some of the more important draft additions are present in Article 9. Article 9 consists of Investigations and Enforcement. The draft regulations clarify how consumers can file complaints under the California Consumer Privacy Act (CCPA) with the CPPA. Sworn complaints would be able to be filed with the Enforcement Division electronically, in person, or by mail.
A complaint would have to identify the business, service provider, contractor, or person who allegedly violated the CCPA. It would have to state the facts supporting each alleged violation and include documents or other evidence supporting the conclusion.
Particular to complaints filed with the CPPA, it would have to authorize the Defendant and CPPA to communicate regarding the complaint. As a sworn complaint, it would need to be signed and submitted under penalty of perjury.
In addition to consumer complaints followed-up on by the agency, the draft regulations also would authorize agency-initiated investigations.
The draft regulations would also allow the CPPA to utilize probable cause proceedings when the evidence supports a reasonable belief that the CCPA has been violated.
The draft regulations would allow for stipulated orders between the Head of Enforcement and the entity who is being investigated. Any such stipulated order would need to be approved by the Board to go into effect.
The draft regulations would also allow the CPPA to conduct audits.
The draft regulations open the door to a lot more enforcement of the CCPA. Ultimately, that is good for consumers but represents greater risk for businesses. Fortunately, Clarip can help businesses comply with the CCPA and help reduce their risk of being investigated or having an enforcement action against them by the CPPA. Clarip provides businesses with automated data subject request fulfillment, automated data mapping, consent management, website scanning, vendor management, and much, much more. Visit us at www.clarip.com or call us at 1-888-252-5653 to learn more.
Email Now:
Mike Mango, VP of Sales
mmango@clarip.com