California Privacy Protection Agency Likely Will Not Meet Privacy Regulation Deadlines

As previously reported, the California Privacy Protection Agency (“CPPA”) is seeking to enact the California Privacy Rights Act (“CPRA”) to amend the California Consumer Privacy Act (“CCPA”). The CPPA had released public comments it received in drafting the CPRA, which was supposed to be finalized by July 1, 2022.  That date would have afforded organizations a six-month compliance window before the act's January 1, 2023 effective date.  Enforcement of the act was set to begin on July 1, 2023. However, during a public board meeting held on February 17, 2022, the CPPA indicated it would not be meeting its July 1 deadline.

According to CPPA Executive Director Ashkan Soltani, the delay is the result of a staffing shortage in the newly formed CPPA to process the substantial amount of information to be collected, assessed, and decided upon in issuing a new rule. In discussing the delays, Director Soltani’s stated at the public board meeting “we are building the car while driving it.”

The CPPA projects that the final regulations will be released by the third or fourth quarter of 2022. This delay is significant because it deprives businesses of the built-in six-month time frame that the agency initially determined was necessary in developing CPRA compliance policies based on a finalized version of the regulation.

Though it is possible the CPRA’s July 1, 2023 enforcement deadline will be extended, there is no guarantee of such extension. Accordingly, despite the CPPA’s delay in issuing final regulations, organizations who will be subject to the CPRA should consider beginning the necessary procedures to review and amend their policies so that they can meet the 2023 compliance deadline.