Thanks to the California Privacy Protection Agency’s failure to meet a statutory deadline for adopting final regulations implementing the state’s Consumer Privacy Act (CCPA), California employers have more time before the Agency can enforce those regulations. A judge of the Superior Court, County of Sacramento (Hon. James P. Arguelles), recently granted the Chamber of Commerce’s request for an order enjoining the Agency from taking such action until the regulations have been final for one year.
The CCPA (Civil Code Section 1798.100, et seq.) requires California businesses to inform consumers about the collection and use of the consumer’s personal information. The Act prohibits businesses from collecting, using, retaining, or sharing such information except to the extent “reasonably necessary and proportionate to achieve the purposes for which” the information is obtained. The legislature granted businesses a temporary exemption from complying with the Act with respect to personal information of employees, owners, directors, or officers of the business, but that reprieve expired on January 1, 2023. As of that date, employers (and other businesses) still lacked guidance about what specific measures would be required to comply with the Act.
The 2020 amendment to the CCPA required the Agency to adopt “final regulations required by the act [by] July 1, 2022.” The legislature further provided that “civil and administrative enforcement” of the CCPA could not commence “until July 1, 2023” – one year later. The Agency, however, missed the July 1, 2022, deadline by many months; the California Consumer Privacy Act Regulations were not “final” until March 29, 2023. The Chamber of Commerce argued that the Agency’s delay deprived businesses of the intended one-year time period within which “to become compliant with the regulations.” The court agreed, and therefore enjoined the Agency from enforcing its March 29, 2023, regulations until March 29, 2024 (Chamber of Commerce v. California Privacy Protection Agency, No. 34-2023-80004106, June 30, 2023). It’s unclear whether the Agency will seek review of the ruling.
Businesses no doubt would benefit from additional time to become compliant with the CCPA. Among other things, the March 2023 regulations require businesses to adopt a formal “privacy policy,” to draft disclosures that must be provided to consumers “at or before the point of collection” of information, and to “design and implement methods for [consumers to] submit[]” requests to the business (such as a “right to know” what information has been collected, “right to delete” certain information, and “right to correct” inaccurate information). Employers may want to consider preparing separate notices to applicants and to employees – both groups are “consumers” under the Act.
Kate LaQuay is a partner resident in Munck Wilson’s Los Angeles office.
Munck Wilson Mandala is a full-service law firm known for its accomplished teams that represent clients in employment counseling and litigation. The firm has offices in Texas, California, and Florida, and represents clients from start-ups to Fortune 50 companies. Learn more about the firm at http:/www.munckwilson.com.
