California Appellate Court Empowers Privacy Agency to Immediately Enforce CPRA Regulations

On February 9, a California appellate court issued a decisive ruling in favor of the California Privacy Protection Agency (the Agency), allowing the state to immediately begin enforcement of its new regulations, effectively overturning a prior decision that had delayed the enforcement of regulations created under the California Consumer Privacy Act (CCPA) until March 29, 2024. This judgment rejects the argument that the CCPA mandated a one-year grace period for businesses to comply with the new regulations, clarifying that the statute does not explicitly require such a delay for enforcement to commence. The court merely emphasized the Agency’s duty to evaluate various factors when contemplating enforcement of the regulations, including the elapsed time since the regulatory requirements were established and the business’s genuine efforts toward compliance.

The ruling carries significant implications for businesses previously relying on an extended timeline for compliance, urging an immediate review and update of privacy practices to adhere to the regulations. It not only impacts the enforcement of the Agency’s March 2023 regulations but also signals a broader precedent for the swift enforcement of future regulations, including currently pending regulations concerning automated decision-making, privacy impact assessments, and cybersecurity audits.

The Impact on Clients

In light of the appellate court ruling, it is imperative for businesses that previously relied on an extended timeline for compliance to reassess and, if necessary, update applicable aspects of their privacy program to align with the current CCPA regulations without delay.

Following this decision, the Deputy Director of Enforcement for the Agency, Michael Macko, stated, “We are pleased that the court has restored our full enforcement authority, and our enforcement team stands ready to take it from here. This decision should serve as an important reminder to the regulated community: now would be a good time to review your privacy practices to ensure full compliance with all of our regulations.”

Given these developments, businesses that have yet to take proactive steps toward compliance must act promptly to reassess and enhance their compliance programs. This entails a thorough review of existing privacy policies and procedures, ensuring they meet the standards set forth in the March 2023 regulations and are robust enough to adapt to the additional requirements anticipated from the new rules under consideration.

Taking Action

It is crucial for businesses to quickly adapt to the CCPA, which are now enforceable. In light of this, we recommend that covered businesses revisit their compliance strategies and immediately consider the following streamlined, actionable compliance strategy:

Privacy Policy Updates: Review and update your privacy policies and notices to customers, job applicants, and current employees to reflect the more burdensome requirements of the California Privacy Rights Act (CPRA) regulations fully. This update should detail, among other things, the categories of personal information collected, the business purposes for processing and further disclosing, retention periods, and how consumers can exercise their rights under the CCPA.

Contractual Audits: Audit and update all contracts with service providers, vendors, subcontractors, and any third parties that have access to consumer or employee data. Ensure these contracts are updated to incorporate required CCPA/CPRA provisions to safeguard against potential compliance gaps, such as disclosing personal data to a vendor being unexpectedly construed as selling personal data.

Digital Compliance Assurance: Assess and adjust your website’s cookie management and privacy practices to meet CCPA/CPRA requirements if your use of cookies may be considered a sale or sharing of personal information for purposes of cross-context behavioral advertising. This includes ensuring your cookie banners offer clear choices to users and reevaluating your website and online interfaces to eliminate any dark patterns that might impair consumer autonomy or choice. Ensure your digital practices, including cookie consent and data collection disclosures, are transparent and compliant.

Process Optimization for Consumer Rights Requests: Enhance your mechanisms for receiving and processing CCPA consumer rights requests to be efficient and compliant with the regulations. This involves establishing multiple accessible channels for requests, such as via opt-out links and honoring browser opt-out preference signals such as the Global Privacy Control, and ensuring your system can effectively record and track such requests.

The Road to Today

After the passage of the landmark CCPA, state privacy advocacy groups successfully introduced ballot initiative Prop 24, also known as the CPRA, which voters approved in November 2020. The CPRA not only amended and expanded the CCPA but also established the first in the nation, California Privacy Protection Agency (Agency), with the mandate to adopt comprehensive regulations by July 1, 2022, and to start enforcing these regulations by July 1, 2023.

However, the Agency encountered delays in its rulemaking and did not meet the July 1, 2022, deadline; instead, publishing its regulations on March 29, 2023. In response to the delay, the California Chamber of Commerce filed a lawsuit against the Agency, arguing for a one-year postponement of enforcement from the date the Agency adopted the required regulations to give businesses time to comply. In June 2023, a California Superior Court ruled in favor of the California Chamber of Commerce. That June 2023 ruling also established that any future regulations issued by the Agency would also be subject to a 12-month stay of enforcement from their date of finalization.

The Agency appealed the Superior Court’s decision. In the meantime, the Agency maintained that, even without enforceable regulations, it retained the authority to enforce the underlying statutory terms of the CCPA. It proceeded to conduct investigations into compliance but stopped short of issuing any fines or penalties under the CCPA framework during this period.

Concurrently, and underscoring its commitment to upholding the CCPA’s consumer rights provisions despite the ongoing legal and regulatory debates, the California Attorney General exercised its independent statutory enforcement powers with respect to the underlying CCPA statute. A notable instance of this enforcement power was the Attorney General’s investigation and subsequent extraction of a $1.2 million settlement with Sephora upon allegations that the company failed to comply with consumer requests to opt out of data collection and sharing, including a failure to honor browser-enabled opt-out preference signals.

The Appellate Court’s Reversal

On February 9, a California appellate court ruled in favor of the Agency, overturning the Superior Court’s decision that had postponed the enforcement of the CCPA regulations until March 29, 2024. That court rejected the California Chamber of Commerce’s argument that a one-year delay between the adoption of regulations and the start of enforcement aligned with statutory requirements and voter intent. Rather, the court determined that the statutes of the CCPA did not explicitly mandate such a delay. The court explicitly found that there was no clear legislative or voter intention supporting the necessity of a delay.

Instead, the court highlighted the Agency’s responsibility to consider various factors when deciding to initiate investigations or enforcement actions. This includes the time elapsed since the regulatory requirements came into effect and the efforts made by businesses to comply in good faith.

Thus, businesses should act swiftly to reassess, finalize, and strengthen their compliance programs, paying particular attention to the forthcoming regulations’ broader implications on operations, especially concerning the use of artificial intelligence.

While the ruling affects the enforcement of the Agency’s March 2023 regulations, it also sets the precedent for how future regulations currently under consideration by the Agency will be enforced. These forthcoming rules delve into areas such as automated decision-making, privacy impact assessments, and cybersecurity audits, signaling another significant expansion of the regulatory landscape. Specifically, many businesses will be required to conduct thorough, independent audits of their cybersecurity measures and navigate comprehensive regulations concerning the deployment of artificial intelligence in their business operations.

Moreover, it is crucial for businesses to understand the broader implications of these forthcoming regulations on their operations, particularly regarding the use of artificial intelligence. Preparing for these changes may involve engaging in strategic planning sessions, conducting internal audits, and leveraging legal and technical advice to effectively navigate the complexities of compliance.

Foley is here to help you address both the short- and long-term impacts of these regulatory developments. We have the resources to help you navigate these and other important legal considerations related to business operations and industry-specific issues. Please reach out to the authors, your Foley relationship partner, or our Technology Transactions, Cybersecurity, and Privacy Group with any questions.

Disclaimer

This blog is made available by Foley & Lardner LLP (“Foley” or “the Firm”) for informational purposes only. It is not meant to convey the Firm’s legal position on behalf of any client, nor is it intended to convey specific legal advice. Any opinions expressed in this article do not necessarily reflect the views of Foley & Lardner LLP, its partners, or its clients. Accordingly, do not act upon this information without seeking counsel from a licensed attorney. This blog is not intended to create, and receipt of it does not constitute, an attorney-client relationship. Communicating with Foley through this website by email, blog post, or otherwise, does not create an attorney-client relationship for any legal matter. Therefore, any communication or material you transmit to Foley through this blog, whether by email, blog post or any other manner, will not be treated as confidential or proprietary. The information on this blog is published “AS IS” and is not guaranteed to be complete, accurate, and or up-to-date. Foley makes no representations or warranties of any kind, express or implied, as to the operation or content of the site. Foley expressly disclaims all other guarantees, warranties, conditions and representations of any kind, either express or implied, whether arising under any statute, law, commercial use or otherwise, including implied warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall Foley or any of its partners, officers, employees, agents or affiliates be liable, directly or indirectly, under any theory of law (contract, tort, negligence or otherwise), to you or anyone else, for any claims, losses or damages, direct, indirect special, incidental, punitive or consequential, resulting from or occasioned by the creation, use of or reliance on this site (including information and other content) or any third party websites or the information, resources or material accessed through any such websites. In some jurisdictions, the contents of this blog may be considered Attorney Advertising. If applicable, please note that prior results do not guarantee a similar outcome. Photographs are for dramatization purposes only and may include models. Likenesses do not necessarily imply current client, partnership or employee status.