Enforcement Of California Privacy Rights Regulations Delayed Until 2024

On June 30, 2023, The California Superior Court of Sacramento County (the Court), in California Chamber of Commerce v California Privacy Protection Agency, No. 34-2023-80004106-CU-WM-GDS (Cal. Super. June 30, 2023) (minute order), granted the Chamber of Commerce’s Writ of Mandate in part, which delayed enforcement of the first set of regulations implemented under the California Privacy Rights Act of 2020 (CPRA) from July 1, 2023, to March 29, 2024. The Court also mandated a one-year grace period between the adoption of future CPRA regulations and their regulatory enforcement.

In 2018, the California Legislature enacted the California Consumer Privacy Act of 2018 (CPPA) that provides consumers with rights regarding the collection and use of their personal data. This was followed in November 2020, where California voters approved the CPRA that established new requirements regarding the collection, retention, and use of consumer data; and imposed new obligations governing personal information. The CPRA also created the California Privacy Protection Agency (Agency) to implement and enforce the new law.

The Agency was granted rulemaking authority under the CPRA and tasked with finalizing regulations under the CPRA by July 1, 2022, with enforcement of said regulations commencing a year later on July 1, 2023. However, the first set of regulations under the CPRA was not finalized until March 29, 2023. If held to the original enforcement deadline of July 1, 2023, businesses subject to the CPRA would only have three months to ensure compliance.  

In response, the California Chamber of Commerce sought to delay enforcement of the CPRA regulations by arguing that a one-year grace period is implied under the CPRA and should be upheld by the Court. In reviewing the CPRA, the Court found that “voters intended there to be a gap between the passing of [the] final regulations and [the] enforcement of those regulations” and agreed with the California Chamber of Commerce that a one-year grace period allows “sufficient time for affected businesses to become compliant” with the regulations. As a result, the Court held that enforcement of the new CPRA regulations could not occur until one year after being finalized, and delayed enforcement until March 29, 2024. Further, the Court determined that any future regulations promulgated by the Agency will be enforced a year after the Agency finalizes the regulations.

Summary By: Victoria Di Felice