CPPA board votes unanimously to advance regulations

The California Privacy Protection Agency (CPPA) board on February 3, 2023 voted unanimously to adopt and approve the Agency’s rulemaking package, as modified, to further implement the California Consumer Privacy Act (CCPA) and update existing regulations.

The rulemaking package includes a redline of the final regulations and a draft final statement of reasons (FSOR) and appendices containing responses to the feedback received during the public comment periods. To complete the rulemaking process, the board also directed staff to file the final rulemaking package with the California Office of Administrative Law (OAL) within the next two weeks.

The proposed regulations will not be effective until approved by the OAL, which will have 30 business days to review them once received. Pursuant to the timelines prescribed by the California Administrative Procedures Act, the earliest the proposed regulations could take effect is April 2023; however, this estimate is subject to change. If the OAL were not to approve the final rulemaking package, for instance, the CPPA would have an additional 120 days to cure any deficiencies.

The formal rulemaking process to adopt the proposed regulations began on July 8, 2022. The proposed regulations revise existing CCPA regulations to harmonize them with amendments to the CCPA adopted pursuant to Proposition 24, the California Privacy Rights Act.

During its February 3, 2023 meeting, the board also voted to solicit pre-rulemaking feedback from the public regarding cybersecurity audits, risk assessments, and automated decision-making. The CPPA reportedly intends to issue the invitation for public comment in the coming weeks.