A decision by California's Third District Court of Appeal has allowed the California Privacy Protection Agency (CPPA) to resume enforcement efforts. On February 9, 2024, the Court overturned a California Superior Court decision that previously delayed enforcement of the latest California Consumer Privacy Act (CCPA) regulations until March 29, 2024. This reversal means that the latest CCPA regulations are now in effect, and the CPPA can begin enforcement immediately.
The basis for the case brought by the California Chamber of Commerce (the Chamber) was the enforcement timing of the CCPA regulations promulgated pursuant to requirements of the California Privacy Rights Act (CPRA), which included substantially revised specifications for organizations' use, disclosure, and processing of personal information. The CPRA, which was approved by California voters via a 2020 ballot initiative, gave rulemaking and enforcement authority to the CPPA. The CPPA was set to begin enforcement pursuant to this authority beginning on July 1, 2023; however, the Chamber argued that the CPRA required the agency to adopt final regulations by July 1, 2022, and the CPPA's failure to do so did not accomplish the voters' intent for enforcement to be delayed for 12 months following the issuance of the final regulations. The lower court sided with the Chamber in finding that, because the CPPA didn't adopt its CCPA regulations until March 29, 2023, the agency could not begin enforcement until one year following such adoption.
Although the lower court's ruling did not impact the validity of the regulations themselves, nor the enforcement of the CCPA and its earlier regulations, the delay bought businesses subject to the CCPA additional time to comply with the latest regulations adopted pursuant to the CPRA. In overturning the lower court's ruling, the appellate court found it was not the intention of the voters to block enforcement efforts and that no explicit language mandated the agency delay enforcement until one year after approval of the final regulations.
Takeaway
Following the appellate court's decision, the CPPA's enforcement authority is in effect, and per Michael Macko, the Deputy Director of Enforcement for the CPPA "[O]ur enforcement team stands ready to take it from here." Whether in response to the latest CCPA regulations and their active enforcement or the passage of additional U.S. state laws and regulations, organizations must devote time and resources towards the implementation and maintenance of effective and adaptable privacy programs. For assistance in assessing your organization's obligations and readiness under U.S. state privacy laws, please contact Greta Messer, CIPP/US, or another member of Baker Donelson's Data Protection, Privacy, and Cybersecurity Team.