The anticipated finalization of California Privacy Rights Act regulations has been pushed back again.
While the CPRA takes effect in just under two weeks — on Jan. 1, 2023 — the California Privacy Protection Agency is still working to promulgate final rules. During a Dec. 16 board meeting, CPPA Executive Director Ashkan Soltani said the final rules will likely be released in late January. Under that timeline, with a 30-day review by the California Office of Administrative Law, the regulations would take effect around April. In February, Soltani
The final rulemaking package — to include a Final Statement of Reasons and responses to all public comments throughout the process — would then be presented to the OAL in early to mid-February.
“OAL will have 30 days to review, meaning that if approved, the soonest the regulations could be in effect is in April,” Soltani said, adding if OAL does not approve the proposed regulations, the CPPA would have an additional 120 days “to cure any deficiencies.”
CCPA board member Alastair Mactaggart stressed “time is the enemy here” and urged the board to “think about being satisfied” with the proposed rules when they are presented, and to consider any changes that may be needed under a future rule-making package.
Mactaggart said it's "critical" for the rulemaking package to make its way to the OAL quickly.
“It’s good for the industry, for the community, for advocates, for everybody to know what’s coming down the pike,” he said.
Covered entities have been concerned about compliance, with the CPRA taking effect Jan. 1 without the CPRA finalizing regulations. The board said existing regulations will be in effect until the final regulations are approved.
Loeb & Loeb Partner Jessica Lee, CIPP/E, CIPP/US, CIPM, recently