The California Chamber of Commerce has filed a lawsuit in Sacramento Superior Court on behalf of its members asking the court to order the California Privacy Protection Agency (CPPA) to promptly adopt comprehensive, complete and final regulations implementing Proposition 24.
The lawsuit also asks the court to prohibit any civil or administrative enforcement of Proposition 24 by the Attorney General’s office or the CPPA until businesses receive the implementation time that the voters approved, 12 months after regulations are adopted.
The CPPA announced on March 30 that they had finalized their first substantive rulemaking package and that the approved regulations went into effect immediately.
Unfortunately, those regulations are only one part of the comprehensive set of regulations necessary to implement the sweeping new requirements regarding businesses’ collection, retention, and use of consumer data under Proposition 24. The agency is required to adopt a complete set of final regulations in 15 new substantive areas.
“The CPPA did not meet the voter-imposed deadline to adopt regulations implementing Proposition 24, the California Privacy Rights Act,” said CalChamber President and CEO Jennifer Barrera. “In approving Proposition 24, the voters provided a one-year period for businesses to adjust their practices and comply with the law. With an incomplete set of regulations in place and no assurance from the agency that enforcement will be delayed, we were compelled to file this lawsuit to ensure California businesses have time to comply with a complicated set of new regulations.
“We are simply asking the court to order the agency to adopt final regulations and abide by the timelines for enforcement that were approved by the voters.”
Consumers will not be left without protections as a result of this lawsuit. The relief sought has no bearing on the ability to enforce the California Consumer Privacy Act (CCPA) as it stood prior to Proposition 24.
The lawsuit names both the CPPA and the California Attorney General’s Office. Both are named because the CPPA has responsibility for promulgating yet-to-be finalized regulations, and both CPPA and the Attorney General have authority to bring civil enforcement actions if businesses fail to comply with those regulations.
