The California Privacy Protection Agency is the new agency established by the California Privacy Rights Act to implement and enforce the law. On June 14, the five-member CPPA Board held its first public meeting over Zoom. The 15 agenda items focused primarily on informational and logistical tasks as the board considered what is needed to create the agency. Not surprisingly, the July 1, 2022, deadline for adopting final CPRA regulations overshadowed much of the discussion.  

The IAPP previously reported on the appointment of the CPPA Board Members and its anticipated priorities this past March. 

Agency transparency and board organization

Deputy General Counsel for the Business, Consumer Services and Housing Agency Philip Laird began the meeting with a presentation regarding California’s Bagley-Keene Open Meeting Act. Bagley-Keene requires the board to conduct its meetings and make its decisions in public. “Meeting” is defined broadly to mean any time a majority of the board members are in the same place “to hear, discuss, or deliberate upon any item that is within [its] subject matter jurisdiction.” Closed sessions are permitted in certain limited circumstances, like personnel matters, but decisions made in closed sessions need to be publicly announced. 

A notice and agenda for each meeting must be provided to the public 10 days in advance and only items properly noticed can be considered. The CPPA’s new website has meeting information, including materials provided in advance of and considered during the meeting. 

One of the challenges for the board is how to meet its obligations under Bagley-Keene while trying to move quickly to put the agency in place and start the rulemaking process. It is planning to meet monthly to start and work in subcommittees, which are not subject to Bagley-Keene if they are limited to two members and the work is in an advisory capacity only. The three subcommittees at present are:

• Regulations — to advise the board on priorities and planning for the rulemaking process (Chairperson Jennifer Urban and Board Member Lydia de la Torre).
• Public Awareness and Guidance — to promote public awareness and provide guidance to consumers and businesses as required by the CPRA (Board Members Vinhcent Le and Christopher Thompson). 
• Start Up and Administration — to work on the administrative issues involved in building the agency (Chairperson Urban and Board Member Angela Sierra). 

The board also discussed what authority to give Urban to act on its behalf for administrative purposes, considering a proposed Delegation of Authority. 

Timing and status of rulemaking

The rulemaking process for the CPRA described by Laird mirrors the process followed by the Office of the Attorney General for the California Consumer Privacy Act. The board will need to prepare an initial notice package that includes proposed regulations and an initial statement of reasons explaining the purpose and necessity of each regulation. Given the anticipated financial impact of the CPRA regulations, a standardized regulatory impact analysis that analyzes the economic impact of the proposed regulatory actions also will be required. 

The board will receive and review public comments on the proposed regulations based on specific prescribed timelines, revise the regulations and ultimately file the final rulemaking package with the Office of Administrative Law for approval. The OAL then has 30 business days (currently extended by an Executive Order) to complete its review. Given the July 1, 2022, deadline, the target date for the final rulemaking package to be submitted would be mid-May 2022.

It does not appear the attorney general’s office is engaging in CPRA rulemaking activities, leaving this work to the CPPA. In terms of the scope of the regulatory action required, Laird confirmed the existing CCPA regulations will remain in place, subject to the board’s modifications. 

The board considered whether to advise the attorney general it was “prepared” to assume rulemaking responsibility, as required by the CPRA. It decided not to move forward with providing the required notice but plans to revisit the issue at the next meeting. In the discussion, Urban pointed out there is some ambiguity in the CPRA regarding the timing for the agency to assume rulemaking responsibility. The regulations provision, Section 1798.185(d), states the agency will assume rulemaking “[b]eginning the later of July 1, 2021 or six months after the agency provides notice to the Attorney General” and the language in Section 1798.199.40(b), a provision establishing the agency, states “[o]n and after the earlier of July 1, 2021, or within six months of the agency providing the Attorney General notice. . .”. Pending Assembly Bill 694 would fix this discrepancy and revise Section 1798.199.40(b) so it also reads “later.”  

The board is planning to investigate what preliminary rulemaking activities may be appropriate (perhaps similar to the CCPA) and priorities for the rulemaking process. 

Hiring and location

The meeting included a discussion regarding the CPPA’s hiring priorities and challenges. The immediate focus will be on hiring an executive director. It also is considering chief deputy director of administration and general counsel positions. 

One of the hiring challenges for the agency is that it does not yet have a location for its office(s). While Sacramento seems likely, satellite offices also were discussed.

The board plans to consider whether there are experienced staff in the attorney general’s office that can assist the CPPA with the rulemaking function. 

Future agenda items

Board members identified a number of potential agenda items for future meetings, including:

• Status of hiring and interviewing.
• Reports from the established subcommittees.
• Additional informational presentations regarding the law.
• What forums or conferences the CPPA should attend.
• The delegation of authority to the chairperson.
• Possible strategic directives for the executive director.
• How the OAG staffed the CCPA rulemaking process for guidance purposes.
• The issue of providing the attorney general notice the CPPA is prepared to assume rulemaking authority.

Member de la Torre raised if the CPPA should consider California applying for EU adequacy. Given the board’s immediate focus on the rulemaking process and administrative issues, it seems unlikely there will be substantial discussion on this topic in the near term. 

Conclusion

There is significant work ahead for the board. It will be building the agency from the ground up and moving forward with the required CPRA rulemaking. We will continue to monitor the CPPA’s progress and report on any developments, including rulemaking activities. 

Photo by Vital Sinkevich on Unsplash