April 2023: California OAL Approves CCPA Regulations

Update Applicable to:
All businesses that record consumer data in the state of California.

What happened?
On March 30, 2023, the California Privacy Protection Agency (Agency) announced that the California Office of Administrative Law (OAL) approved the Agency’s first substantive CCPA rulemaking package.

What are the details?
According to the Agency, the “regulations have not changed substantively since the Agency Board voted on modifications made at its October 29, 2022, meeting.” The text of the final regulations and supporting materials were not immediately available but will be posted here once processed.

The OAL’s approval concludes an eighteen-month rulemaking process that began in September 2021 with the Agency soliciting preliminary comments from the public via an initial Invitation for Comments. The Agency issued draft regulations on May 27, 2022, and commenced formal rulemaking on July 8, 2022.

The OAL’s approval also comes roughly twenty-seven months after the Agency was officially established on December 16, 2020. On that date, the California Secretary of State certified the results of the November 2020 election in which California voters passed Proposition 24 – the California Privacy Rights Act of 2020.

Notwithstanding today’s approval, the Agency has already begun additional rulemaking. The Agency issued an Invitation for Preliminary Comments on Proposed Rulemaking on cybersecurity audits, risk assessments, and automated decision-making in February.

The OAL’s approval of the first rulemaking package is another significant milestone in developing US privacy law. Combined with the Colorado Attorney General’s office’s recent finalization of Colorado Privacy Act (CPA) rules and the upcoming effective dates of the CPA and Connecticut Data Privacy Act, the US is entering a new era of privacy law.

The approved regulations, which are immediately effective, can be enforced beginning July 1, 2023.

For more information, please see the links below:

CPPA Announcement

California Consumer Privacy Act Regulations

Invitation for Preliminary Comments on Proposed Rulemaking

Article

What do employers need to do?
Employers should review the links above and change their data collection policies to ensure compliance with the law.