In an eleventh-hour ruling made shortly before enforcement of the California Privacy Rights Act’s regulations was set to begin on July 1, a California judge has delayed enforcement until March 29, 2024. The delay reduces the pressure on businesses who had been facing potential enforcement of unfinalized regulations. However, the ruling is not a complete reprieve as the delay does not affect enforcement of the statute itself which can still be enforced as of July 1 by both the California Privacy Protection Agency (“CPPA”) and the California Department of Justice.
Businesses had been preparing for the imminent enforcement of the regulations, and the delay gives welcome relief and more time to properly evaluate the regulations, which deal with important issues such as consumer opt-out mechanisms, handling consumer requests under the statute, and data processing agreements.
The decision came in a case brought by the California Chamber of Commerce after the CPPA admitted that it would not meet the statutorily mandated deadline for finalizing the regulations (and, indeed, the first of at least two sets of regulations was only just barely finalized in late March 2023). The Chamber had sought to delay enforcement of the entire CPRA until twelve months after all regulations were completed. The Sacramento County Superior Court declined to go quite that far, and refused to delay enforcement of the statute itself, but the Court granted the Chamber’s request for an injunction and delayed enforcement of the regulations until March 29, 2024. Additionally, the Court ruled that any future regulations will also not be enforced until one-year from the date of enactment.
What the Ruling Means for Businesses
Businesses subject to the CCPA[1] as amended by the CPRA will now have an additional nine months to comply with the March 29, 2023 CPRA regulations. However, because the Court refused to delay enforcement of the statute itself, businesses still must comply with the CPRA itself, which made several important changes to the CCPA. (AALRR previously covered how businesses can prepare for the CPRA in a three part blog series which can be found here, here, and here).
For example, the Court’s decision did not affect the expiration of exemptions for employee, job applicant and business-to-business data, which are now subject to the law. Accordingly, if you have not already done so, your business needs to update its privacy notices and policies to address the new requirements.
The Court’s ruling does, however, mean that businesses should prioritize ensuring compliance with currently enforceable statutory requirements. Businesses should focus now on meeting the current requirements and developing a strategy for understanding the regulations and taking advantage of the delay to become fully compliant with the complex regulations.
AALRR is ready and able to help with this process and or any questions you may have. Please contact the authors of this article or your trusted adviser at AALRR to discuss next steps or questions.
[1] Is My Business a Covered Business Subject to the CCPA/CPRA? A covered business is one that (1) conducts business in California for the profit or financial benefit of their shareholders or owners, (2) collects consumers’ (i.e., California residents) personal information, and (3) that meets any of the following three thresholds:
- Has annual gross revenues in excess of $25 Million; or
- Annually buys, receives, sells, or shares for commercial purposes the personal information of 100,000 or more consumers, households, or devices; or
- Derives 50% or more of its annual revenues from selling or sharing consumers’ personal information.
Covered businesses also include companies and individuals that control or are controlled by a business that satisfies the above requirements and have common branding (e.g., name, service mark, trademark, etc.) with a business that satisfies the above requirements.
This AALRR post is intended for informational purposes only and should not be relied upon in reaching a conclusion in a particular area of law. Applicability of the legal principles discussed may differ substantially in individual situations. Receipt of this or any other AALRR publication does not create an attorney-client relationship. AALRR is not responsible for inadvertent errors that may occur in the publishing process.
© 2023 Atkinson, Andelson, Loya, Ruud & Romo
- Of Counsel
Christopher Francis is a seasoned litigator who focuses his practice on representing clients in complex domestic and international litigation cases. His practice includes investigating and defending allegations of Foreign ...
- Partner
Brian Wheeler is Chair of the firm’s Commercial and Complex Litigation Practice Group. He also leads the firm’s Intellectual Property and Data Privacy practices within the Practice Group, overseeing AALRR’s team of ...
Other AALRR Blogs
Recent Posts
- Alert: FinCEN Announces Limited Extensions to Corporate Transparency Act Reporting Deadlines
- Court of Appeal Sheds Light On The Rights Of Limited Liability Companies And Its Members
- Dueling OpenAI Copyright Cases to Remain Separate, Parallel Actions on Both Coasts
- Section 16600 and the Fate of Trade Secret Exception
- The Contract Is In The Details
- Teaming With Our Clients – California Adopts “Initial Disclosures” in State Court Civil Litigation
- Recent Court of Appeal Decision Shows The Limits Of Exculpatory Clauses In Commercial Leases, Including Limitation of Damages Provisions
- Understanding Deceptive California Statement of Information Scams
- Closing of Pre-Hearing Discovery Loopholes in Arbitration
- International Enforcement of U.S. Trademarks: Simplicity for Complexity’s Sake
Popular Categories
- (26)
- (24)
- (1)
- (15)
- (4)
- (4)
- (2)
- (3)
- (3)
- (2)
- (2)
- (5)
- (2)
- (4)
- (5)
- (4)
- (1)
- (1)
- (3)
- (2)
- (1)
- (1)
- (1)
- (1)
- (1)
- (1)
- (1)
- (1)
- (1)
- (1)
- (1)
- (1)
- (1)
- (1)
- (1)
Contributors
- Cindy Strom Arellano
- Reece C. Bennett
- Eduardo A. Carvajal
- Michele L. Collender
- Scott K. Dauscher
- Christopher M. Francis
- Evan J. Gautier
- Carol A. Gefis
- Edward C. Ho
- Micah R. Jacobs
- John E. James
- Jonathan Judge
- David Kang
- Jeannie Y. Kang
- Joseph K. Lee
- Shawn M. Ogle
- Kenneth L. Perkins, Jr.
- Jon M. Setoguchi
- Jon Ustundag
- Brian M. Wheeler