Key Points:

  • The Draft Regulations introduced by the California Attorney General's Office on October 10, 2019 are subject to a public comment period and public hearings that will close on December 6, 2019. Now is the time to act to try to influence the final regulations.
  • The Draft Regulations are a mixed bag—they contain some helpful clarifications, include some additional obligations beyond the CCPA's current requirements and leave various ambiguous issues either unaddressed or unresolved.
  • The Draft Regulations go beyond the CCPA in several important ways and introduce new requirements, including new recordkeeping requirements for businesses that alone or in combination receive or share records of four million or more California residents.

1. Introduction

The California Attorney General's Office (AGO) recently issued its much anticipated draft regulations ("Draft Regulations") for implementation of the California Consumer Privacy Act (CCPA). The AGO also issued a corresponding Initial Statement of Reasons (ISOR) that provides additional explanation. The Draft Regulations are a mixed bag—they contain some helpful clarifications, include some additional obligations beyond the CCPA's current requirements, and leave some ambiguous issues either unaddressed or unresolved. This alert discusses what the Draft Regulations do and do not address and provides practical advice for entities caught in the CCPA's web.

More information on the CCPA can be found in our prior client alerts and publications, including our initial summary of the CCPA, our overview of the September 2018 amendments and our recent article in the Recorder concerning the September 2019 amendments.

The CCPA requires the AGO to adopt regulations to guide businesses in fulfilling their obligations generally, and with regard to seven areas in particular. The Draft Regulations only cover some of those seven areas. The AGO cannot bring an enforcement action until six months after the publication of the final regulations or July 1, 2020—whichever is earlier. Given the current schedule, it appears unlikely that AGO enforcement will begin before July 1, 2020. At the press conference announcing the Draft Regulations, the Attorney General and his staff appeared to imply that they intend to investigate alleged violations that take place between January 1 and July 1, 2020. This seemingly puts businesses on notice of the Attorney General's intention with regard to this interim enforcement period. The AGO is collecting comments on the Draft Regulations until December 6. It will hold four public hearings as part of that process in Sacramento, December 2; Los Angeles, December 3; San Francisco, December 4; and Fresno, December 5. Thereafter, the AGO will either issue revised regulations or submit the final text of the regulations to the Office of Administrative Law (OAL). The timing and exact process depends, in part, on the AGO's response to comments. The regulations go into effect upon OAL approval.

To view the full article please click here.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.