California Appellate Court Overturns Lower Court Ruling Delaying CPRA Regulations Enforcement | Practical Law

California Appellate Court Overturns Lower Court Ruling Delaying CPRA Regulations Enforcement | Practical Law

The California Court of Appeal for the Third District has overturned a lower court's decision in California Privacy Protection Agency v. Superior Court of Sacramento County that delayed CPRA regulations enforcement until March 29, 2024 and required at least one year between regulation finalization and enforcement.

California Appellate Court Overturns Lower Court Ruling Delaying CPRA Regulations Enforcement

by Practical Law Data Privacy & Cybersecurity
Published on 12 Feb 2024 • California
The California Court of Appeal for the Third District has overturned a lower court's decision in California Privacy Protection Agency v. Superior Court of Sacramento County that delayed CPRA regulations enforcement until March 29, 2024 and required at least one year between regulation finalization and enforcement.
On February 9, 2024, the California Court of Appeal for the Third District reversed a lower court's order that enjoined the California Privacy Protection Agency from enforcing California Privacy Rights Act (CPRA) related regulations until 12 months after the date the regulations are finalized (California Priv. Prot. Agency v. Superior Ct. of Sacramento Cnty., (Cal. Ct. App. February 9, 2024)).
The Superior Court of California for Sacramento County held on June 30, 2023 that the inclusion of specific dates in Cal. Civ. Code § 1798.185(d) for regulation finalization and enforcement indicated that voters intended there be a 12-month gap between those events, regardless of when the Agency promulgated the regulations. Under this order, the Agency regulations for 12 of the CPRA's 15 mandatory areas for rulemaking, finalized on March 29, 2023, were not enforceable until March 29, 2024 and the remaining CPRA-required regulations, once finalized, would not be enforceable until 12 months after the California Office of Administrative Law (OAL) approved them (see Legal Update, California Superior Court Delays CPRA Regulations Enforcement).
The Agency appealed the decision in a petition for extraordinary writ relief in the nature of mandamus, which the Court of Appeal granted due to the novel issue of law presented, strong public interest, and need for prompt resolution. While the Court of Appeal agreed that the Agency failed to adopt final regulations by July 1, 2022 in compliance with the CPRA, it found:
  • No clear and unequivocal language in the CPRA mandating a one-year delay between regulation finalization and enforcement, reasoning that if the CPRA drafters intended such a delay they would have stated it unambiguously.
  • No evidence in the California Secretary of State Voter Guide or other relevant materials that indicated that voters contemplated the one-year delay other than the July 1, 2022 and July 1, 2023 dates themselves.
Unless this decision is further appealed or stayed, the Agency is now able to enforce the regulations it finalized on March 29, 2023. The final three areas of regulation will become effective on their finalization dates.
The Agency issued a press release discussing the Court of Appeal's decision and reiterating its commitment to enforcing the CPRA.