by Jeffrey P. Cunard, Luke Dembosky, Jeremy Feigelson, and Avi Gesser
It looks like the California Attorney General’s implementing regulations for the California Consumer Privacy Act (“CCPA”) are, finally, final. On June 1, 2020, the California Attorney General submitted for publication the final proposed regulations.
The California Office of Administrative Law now has 30 working days, plus an additional 60 calendar days under an Executive Order issued in connection with the COVID-19 pandemic, to review and approve the regulations. This means the regulations may not take effect until October 1, 2020. The California Attorney General has requested expedited review in hopes that the regulations can be published by July 1, 2020.
Regardless of the regulations’ final effective date, the California Attorney General’s office has stated that the office remains committed to enforcing the CCPA beginning July 1, 2020. That is when the law becomes enforceable, whether or not the regulations have been published.
The final proposed regulations are unchanged from the second set of draft regulations that were released in March 2020. Our prior update (PDF: 317 KB) describes the major provisions in the March draft.
At a high level, these regulations put “meat on the bones” of the somewhat sparse statutory text of CCPA. Companies covered by CCPA can look to the regulations for details on:
- when and how a business must provide notices to consumers regarding the collection of their personal information, the right to opt out of the sale of their information, and the financial incentives or price or service differences the business offers in connection with the collection and use of personal information;
- the form, content, posting and accessibility of a business’s privacy policy;
- how to verify and respond to consumer requests to know, delete and/or opt out of the sale of their personal information;
- record-keeping, training staff and maintaining metrics on compliance with the CCPA; and
- how to handle minors’ personal information.
It remains to be seen what the California Office of Administrative Law will do, and when, with the Attorney General’s June 1 release. Yet this seems a safe bet: the June 1 version of the regulations will likely become, at some point, the enforceable version. Companies that are mapping their compliance programs to CCPA therefore can look to the June 1 version with confidence as they do so.
Jeffrey P. Cunard, Luke Dembosky, Jeremy Feigelson, and Avi Gesser are partners at Debevoise & Plimpton LLP.
Disclaimer
The views, opinions and positions expressed within all posts are those of the author alone and do not represent those of the Program on Corporate Compliance and Enforcement (PCCE) or of New York University School of Law. PCCE makes no representations as to the accuracy, completeness and validity of any statements made on this site and will not be liable for any errors, omissions or representations. The copyright of this content belongs to the author and any liability with regards to infringement of intellectual property rights remains with the author.