The California Privacy Protection Agency board reached what member Christopher Thompson called “an incredible milestone” June 8, voting unanimously to authorize Executive Director Ashkan Soltani to begin the California Privacy Rights Act rulemaking process.

“I think we all share a desire to ensure that we issue regulations and enforce those regulations in a way that protects consumers’ privacy and allows consumers to understand and make decisions about their own privacy,” Thompson said. 

The agency in late May released CPRA draft regulations in materials for the June 8 public meeting, covering a handful of the 22 regulatory topics the CPPA set out to address, including personal data collection and use restrictions, mandatory user opt-out signal acknowledgement, privacy notice requirements and more.

The board voted 4-0 June 8 to begin the rulemaking process, with one member absent. Breaking down the draft regulations, Deputy Attorney General Lisa Kim said the proposal updates pre-existing California Consumer Privacy Act regulations to “harmonize” them with CPRA amendments and operationalizes and consolidates requirements within the law “so it is easier to follow and understand.”

For members of the business community, the deadline for final CPRA regulations and enforcement has been top of mind. The agency has previously said it will likely miss an initial July 1 statutory deadline to adopt regulations, but has not discussed whether that deadline, and thus enforcement, will be extended. The California Hispanic Chambers of Commerce Assistant Deputy Chief of Staff Luis Lopez called on the agency to commit to extending the enforcement deadline by six months “to give businesses time to comply.”

The board indicated the topic would be placed on an upcoming agenda. Board member Vinhcent Le acknowledged there’s been a “communication gap,” but noted the board is “constrained” by public meeting rules and statutes regarding what it can share and respond to.

“We do know this is something the public is interested in,” Le said.

In February, Soltani said the rulemaking schedule would go “somewhat past” the July 1 deadline, with completion anticipated “in Q3 or Q4.”

The board will next file a Notice of Proposed Rulemaking Action, commencing the formal rulemaking process. The notice will be posted on the agency's website and published in the California Regulatory Notice Register, marking the first day of formal rulemaking. The filing opens a public comment period of at least 45 days during which stakeholders and interested parties can submit written comments. A public hearing will also be scheduled. Details on submitting comments and attending the public hearing will be included in the notice. 

“There are robust procedures for public comment, which we are very much looking forward to,” CPPA board Chairperson Jennifer Urban said.

The board has been working since last fall, she said, in subcommittees with counsel from the Office of the Attorney General to work on the draft regulations, including receiving written comments from the public and holding informational sessions with experts, stakeholders and others.

“We really do look forward to comments that we get through the formal process,” Urban said. “If you are a consumer, let us know what your experience is, that would be very helpful. If you are a business looking to comply, it would also be very helpful to have specifics on any successes or challenges you might anticipate with amendments to the rules and to let us know specifically how that might affect you, as well as any ideas you have for addressing it, including regulatory language.”

The board's next meeting has yet to be scheduled.