In a surprising turn of events, the July 1, 2023 enforcement deadline for the California Privacy Rights Act ("CPRA") regulations may be delayed. The Sacramento Superior Court of California published a tentative ruling on June 29, 2023, stating that "enforcement of any final Agency regulation . . . will be stayed for a period of 12 months from the date that individual regulation becomes final."
The Court stated that the California Privacy Protection Agency's failure to publish regulations by the original July 1, 2022 deadline does not adhere to voter's intent, as exemplified by the plain language of the statute. The Court ruled that it was the intent of the voters to have a 12 month period between the finalization of the regulations and enforcement. Regulations for twelve of the fifteen areas contemplated by the CPRA were finalized on March 29, 2023. Therefore, those twelve areas have an enforcement deadline of March 29, 2024. The three remaining areas where regulations have not been finalized (cybersecurity audits, risk assessments, and automated decision-making) would not have a final enforcement deadline.
However, the ruling is not final – oral arguments are scheduled for June 30, 2023 so we will be monitoring oral arguments and the Court's final ruling. And, enforcement of the CPRA statute, rather than the regulations, can begin on July 1.
This alert provides general coverage of its subject area. We provide it with the understanding that Frankfurt Kurnit Klein & Selz is not engaged herein in rendering legal advice, and shall not be liable for any damages resulting from any error, inaccuracy, or omission. Our attorneys practice law only in jurisdictions in which they are properly authorized to do so. We do not seek to represent clients in other jurisdictions.
