California Superior Court Delays CPRA Regulations Enforcement | Practical Law

California Superior Court Delays CPRA Regulations Enforcement | Practical Law

The Superior Court of California for Sacramento County issued an order postponing the enforcement of California Privacy Rights Act (CPRA) related regulations.

California Superior Court Delays CPRA Regulations Enforcement

Practical Law Legal Update w-039-9762 (Approx. 4 pages)

California Superior Court Delays CPRA Regulations Enforcement

by Practical Law Data Privacy & Cybersecurity
Published on 30 Jun 2023 • USA (National/Federal)
The Superior Court of California for Sacramento County issued an order postponing the enforcement of California Privacy Rights Act (CPRA) related regulations.
On June 30, 2023, the Superior Court of California for Sacramento County issued an
order
enjoining the California Privacy Protection Agency (CPPA) from enforcing California Privacy Rights Act (CPRA) related regulations until 12 months after the date the regulations are finalized.
The California Office of Administrative Law (OAL) approved final regulations for 12 of the CPRA's 15 mandatory areas of regulation on March 29, 2023, to be enforceable as of July 1, 2023 (see Legal Update, California Office of Administrative Law Approves Final CPRA Regulations).
The California Chamber of Commerce filed suit against the CPPA on March 30, 2023, seeking injunctive relief to postpone CPRA regulations enforcement, arguing the CPRA enforcement provision:
  • Obligated the CPPA to publish final regulations by July 1, 2022, and the CPPA failed to meet that deadline.
  • Requires at least one year between the date the OAL approves the final regulations and the date the CPPA begins to enforce those regulations.
The court agreed in part, declining to set a deadline to finalize regulations, but finding that the CPRA's inclusion of specific dates indicated that voters intended a 12 month gap between regulation finalization and enforcement. The court ordered that:
  • Any regulation implemented under the CPRA enforcement provision will not be enforceable until 12 months after the date the regulation becomes final.
  • Regulations previously passed under the California Consumer Privacy Act of 2018 (CCPA) remain in full force and effect until the CPPA passes superseding regulations.
Under the court's order:
  • The regulations finalized on March 29, 2023 will not be enforceable until March 29, 2024.
  • Regulations for the three remaining areas, including cybersecurity audits, risk assessments, and automated decision-making, will not be enforceable until 12 months after the OAL approves the related rulemaking package.
For more information on the CPRA, see California Privacy Toolkit (CCPA and CPRA).