The Sacramento Superior Court has ruled that the California Privacy Protection Agency (CPPA) must delay enforcement of any individual regulation for a one-year period following the date the regulation goes into effect.
In the June 30 ruling, the court agreed with the assertion by the California Chamber of Commerce that voters intended there to be a gap between adoption of final regulations by the CPPA and the time they could be enforced. The CalChamber argued that it would be unfair to enforce a law against businesses when they don’t even know what the rules are yet.
CalChamber President and CEO Jennifer Barrera said the ruling would provide some certainty and basic fairness for California businesses as they work to comply with the complicated mandates called for in Proposition 24.
“In passing Proposition 24, voters understood that businesses should be provided time to implement new rules before any enforcement action is taken. The Court underscored this today, recognizing that it would be unfair for the CPPA to enforce new regulations when the impacted businesses did not even know what was going to be required of them. We are grateful that the Court recognized the predicament faced by California businesses in these circumstances and provided a commonsense interpretation that aligns with what voters approved in passing Proposition 24,” she said.
Background
In November 2020, California voters approved Proposition 24, known as the California Privacy Rights Act of 2020 (CPRA), amending and expanding upon the California Consumer Privacy Act of 2018. The CPRA established new standards regarding the collection, retention, and use of consumer data and created the California Privacy Protection Agency (CPPA) to implement and enforce the law. The CPRA also imposed new obligations governing personal information, including requirements that businesses adopt certain mechanisms permitting consumers to opt out of data sharing.
In March 2023, the CalChamber filed suit against the newly created CPPA to enjoin the agency from bringing any enforcement actions under CPRA regulations.
The CalChamber argued that because the regulations implementing Proposition 24 (CPRA) were finalized eight months later then the CPPA was mandated to issue the regulations, the agency did not provide businesses with the required 12-month grace period to come into compliance as contemplated under the CPRA.
The CPPA was to have published complete and final regulations by July 1, 2022 with an enforcement date of July 1, 2023. However, the CPPA had not promulgated a final and complete set of regulations in the timeframe called for in Proposition 24 (CPRA) nor by the time the litigation was filed in March 2023. The agency had finalized only its first set of rules on March 29, 2023.
Following the June 30 ruling, the CPPA must create enforcement deadlines that tie directly to the implementation date of each individual rule — a full 12 months following the date they become effective. Accordingly, the first set of rules cannot be enforced until March 29, 2024.
