The California Privacy Protection Agency on July 8, 2022, kicked off the formal rulemaking process to adopt proposed regulations that implement the Consumer Privacy Rights Act of 2020 (CPRA), which amends and expands the California Consumer Privacy Act (CCPA). For an analysis on the themes and key provisions of the draft rules, see the Holland & Knight alert "Early Draft of California Privacy Regulations Focuses on Opt-Out Rights, Disclosures ," June 1, 2022.
According to the Agency's Initial Statement of Reasons, the proposed regulations "place the consumer in a position where they can knowingly and freely negotiate with a business over the business's use of the consumer's personal information." Among other things, the proposed regulations 1) update existing CCPA regulations to address the CPRA amendments; 2) provide guidance to consumers, businesses, service providers and third parties on how to operationalize new rights and concepts introduced by the CPRA; and 3) reorganize and consolidate requirements in the law.
The proposed regulations also "take into consideration privacy laws in other jurisdictions and implement compliance with the CCPA in such a way that it would not contravene a business's compliance with other privacy laws, such as the General Data Protection Regulation (GDPR) in Europe and consumer privacy laws recently passed in Colorado, Virginia, Connecticut, and Utah." Initial Statement of Reasons at 3.
The mandatory public comment period on the proposed regulations is open until 5 p.m. PT on Aug. 23, 2022. The Agency notes that submissions are subject to public disclosure.
The Agency will hold a public hearing on the proposed regulations on Aug. 24-25. Details on attending are available on the Agency's website.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.