CCPA Regulations: Coming Soon from the California Attorney General
The California Attorney General has been tasked by the CA legislature with issuing CCPA regulations on or before July 1, 2020 pursuant to the SB-1121 amendment from August/September 2018. The first draft from the rulemaking process of the CCPA regulation is expected in Fall 2019.
We will update this page with information about the draft and final California Consumer Privacy Act regulations when they are available. In the meantime, here is a description of what has happened so far:
The first version of the California Consumer Privacy Act, AB-375 called on the AG to adopt regulations to further the CCPA after broad public participation on or before January 1, 2020. It also called for the establishment of various rules and procedures within one year (around July 1, 2019). With respect to the opt-out, it asked the AG for regulations to facilitate the submission of an opt-out request, to govern business compliance with the opt-out request, and to create recognizable and uniform opt-out logo or button to be used by all businesses for the opt-out of the sale of personal information. Other rules to be issued within one year centered around the required disclosures to consumers, how to verify consumer requests, and establishing any necessary exceptions due to federal or state law.
The California Attorney General sent a letter to the California legislature in August 2018 indicating that the timeline was unrealistic. The letter also included other suggested changes to the law. In response, the California legislature included a change to the timeline in the SB-1121 amendment to the CCPA.
The SB 1121 CCPA Amendment moved the deadline for the adoption of final regulations back six months from January 1, 2020 to July 1, 2020. It maintained certain language concerning establishing rules and procedures within one year of the passage of the title, such as for establishing the necessary exceptions, the disclosures required by businesses and the facilitation of the verifiable consumer requests.
The California Attorney General’s Office held seven public forums across the state starting in San Francisco on January 8, 2019 and ending at Stanford Law School on March 5, 2019. The public forums gave each speaker five minutes to address one of the seven requirements from Section 1798.185 or other issues with the law. The public comments were transcribed and six of the seven have been published on the AG website.
The seven areas where the AG recommended individuals focus their comments were:
1. Categories of Personal Information
2. Definitions of Unique Identifiers
3. Exceptions to CCPA
4. Submitting and Complying with Requests
5. Uniform Opt-Out Logo/Button
6. Notices and Information to Consumer, Including Financial Incentive Offerings
7. Verification of Consumer’s Request
The California Attorney General’s Office also accepted written public comments by letter or email with a deadline of March 8, 2019. The AG has published the comments it received on its website.
During the public forums, the CA AG also released information about its rulemaking process. After the AG publishes the proposed text of the regulations, there will be a minimum 45-day public comment period as well as additional public hearings. The draft of the CCPA regulation text, called the Notice of Proposed Regulatory Action, is anticipated in Fall 2019. Following the public comment period, the AG will consider whether any major or substantial changes are needed. If one of these changes is needed, it will kick off a new 15 or 45 day comment period. Otherwise, the AG will publish the final text of the CCPA regulations as well as a final statement of reasons. This will close the rulemaking process.
The SB-1121 amendment provides that the Attorney General may begin its CCPA enforcement either on July 1, 2020 or six months after the final regulations are published, whichever is earlier.
The current timeline for the California Consumer Privacy Act regulations gives businesses a tight window to implement any changes required by the guidelines before enforcement by the California AG begins. Most businesses will need to be prepared with a plan and draft procedures before the final regulations are released.
GET OUR FREE WHITE PAPER ON THE NEW CALIFORNIA LAW:
Additional Resources:
CCPA Summary
Data Portability for CCPA DSAR Access Responses
What is a CCPA business purpose or commercial purpose?
The Broad CCPA Definition of Sale
CCPA Definition of Consumer
CCPA Look Back Period Requirement
CCPA Household Definition & Challenges
CCPA Training Requirement – Section 1798.130(a)(6)
CCPA Regulations: Coming Soon from the California Attorney General
Loyalty Programs, AB-846, and the CCPA Anti-Discrimination Clause