Businesses awaiting final California Consumer Privacy Act (CCPA) regulations will likely be waiting until after enforcement of the CCPA begins on July 1.
Prior to the regulations taking effect, the attorney general must submit proposed regulations to the state Office of Administrative Law (OAL) for review to comply with the State Administrative Procedures Act. Once submitted, OAL typically has 30 working days to conduct its review and then either approve the rulemaking action and file the proposed regulation with the Secretary of State or disapprove the rulemaking action. Governor Gavin Newsom has extended this timeframe by an additional 60 days due to the COVID-19 pandemic. Generally, regulations become effective only on one of four quarterly dates based on when the final regulations are approved by OAL and then filed with the Secretary of State: January 1 (if filed between September 1 and November 30), April 1(if filed between December 1 and February 29), July 1 (if filed between March 1 and May 31), and October 1 (if filed between June 1 and August 31). This means that, if the AG wants CCPA regulations to become effective July 1, they must be filed with OAL, approved by OAL and submitted to the Secretary of State by May 31.
As of this writing, only 9 days remain until the filing deadline and the AG has not submitted final CCPA regulations to OAL for review. To make the originally-anticipated July 1 effective date, the AG could, theoretically, submit final regulations in the next nine days and ask OAL for expedited review or submit the final regulations late and ask for the July 1 effective date based on “good cause” for earlier enforcement. OAL, however, already has a long list of 55 regulations slated for review. It is also unclear how receptive OAL would be to expediting regulations that (as of the last draft) are nearly 30 pages long. Accordingly, the effective date of the CCPA regulations will likely slip until October 1.
The lack of final regulations creates additional uncertainty for businesses seeking to comply with a statute and regulations fraught with contradictions and ambiguities. Given that the AG has committed to enforcing the CCPA starting July 1, it would be unwise for businesses to wait for final regulations to finish preparing for compliance. Instead, as we previously discussed, where the CCPA is unclear on its own requirements, businesses should consider reviewing past interpretations and enforcement of other privacy laws for guidance.
Businesses need to approach compliance efforts in a manner that is reasonable, defensible and informed. And while it is unlikely that the final regulations will be guiding that effort prior to the start of enforcement, the draft regulations are still instructive.