Privacy Regulations Enforcement Delay Vacated

On February 9, 2024, a California Court of Appeal ordered a lower court to vacate its ruling delaying enforcement of the California Privacy Rights Act (CPRA) regulations — a ruling the lower court issued in the summer of 2023. On February 20, 2024, the CalChamber petitioned the California Supreme Court for review of the case.

To quickly recap, 2020’s Proposition 24, also known as the CPRA, expanded and revised the existing California Consumer Privacy Act (CCPA), which is California’s law governing consumer data collection and retention, as well as rights regarding use of that data.

Notably, a year after voters approved the CPRA, the law’s exemption for employment-related information expired. Covered California businesses were given new obligations and compliance challenges with respect to employment related information, such as such as fulfilling a consumer’s right to correct their data, or place restrictions on sensitive personal information. 

The CPRA also created a new state agency, the California Privacy Protection Agency (CPPA), and directed it to create regulations implementing the revised law no later than July 1, 2022, with enforcement of those regulations set to begin one year later, on July 1, 2023. The CPPA, however, failed to meet that deadline, instead delivering only a portion of the regulations on March 29, 2023 — over eight months after its mandated deadline. 

The CalChamber immediately filed suit against the newly created CPPA to enjoin the agency from bringing any enforcement actions under the regulations because it did not provide businesses with the required 12-month grace period to come into compliance under the CPRA.

As we previously reported, in July 2023, the Sacramento Superior Court ruled that the CPPA must delay enforcement of the new regulations for a one-year period following the date they become final through approval by the Office of Administrative Law (OAL), which would be March 29, 2024. After the ruling, the CPPA took the case to the Court of Appeal and argued that, under the plain language of the statute, the CPPA didn’t have to wait a year from the time of OAL approval.

Despite the statutory gap of one year between final regulations and enforcement, and an admission by the court that the CPPA failed to meet its implementing deadline, the appellate court agreed with the CPPA — concluding that the statute doesn’t explicitly require a one-year gap between approval and enforcement, regardless of when the approval occurs, because there’s no express language linking enforcement of the act with promulgation of the regulations. As such, the Court of Appeal ordered the lower court to vacate its order.

Absent an appeal, based on court procedural timelines, the CPPA could potentially begin enforcing its regulations as early as March 11, 2024, though it may be later depending on the court’s timing.

However, on February 20, 2024, CalChamber petitioned the California Supreme Court for review of the case, urging the court to return to the plain statutory text and intent of the voters to include a 12-month gap between adoption of final regulations by the CPPA and the time those regulations can be enforced.

CalChamber will continue to provide timely updates as circumstances develop. In the meantime, it’s important for CPRA-covered businesses to make every effort to comply with the regulations as soon as possible. Employers should consult their legal counsel with any questions.

James W. Ward, Employment Law Subject Matter Expert/Legal Writer and Editor

Employers can read more about CPRA Background, CPRA Coverage and Employers Obligations Under the CPRA in the HR Library. Not a member? Learn how to power your business with a CalChamber membership.