Business Law Journal

In an eleventh-hour ruling made shortly before enforcement of the California Privacy Rights Act’s regulations was set to begin on July 1, a California judge has delayed enforcement until March 29, 2024.  The delay reduces the pressure on businesses who had been facing potential enforcement of unfinalized regulations.  However, the ruling is not a complete reprieve as the delay does not affect enforcement of the statute itself which can still be enforced as of July 1 by both the California Privacy Protection Agency (“CPPA”) and the California Department of Justice.  

In 2020, the federal government flooded the economy with liquidity to avoid a complete economic collapse during the Covid-19 pandemic.  As part of that effort, the government encouraged the application and expedited granting of Paycheck Protection Program (“PPP”) loans to companies.  At the time (despite numerous questions about what companies and organizations were eligible under the program) speed, not compliance was the watchword. Accordingly, in 2020, many private clubs were encouraged to apply for PPP loans.  Despite the emphasis in 2020 on speed and liquidity, the government is now increasing their investigation and prosecution of companies who may have received or used PPP loans improperly. 

In 2020, the federal government flooded the economy with liquidity to avoid a complete economic collapse during the Covid-19 pandemic.  As part of that effort, the government encouraged the application and expedited granting of Paycheck Protection Program (“PPP”) loans to companies.  At the time (despite numerous questions about what companies and organizations were eligible under the program) speed, not compliance was the watchword. Accordingly, in 2020, many private clubs were encouraged by aggressive lenders to apply for PPP loans.  Despite the emphasis in 2020 on speed and liquidity, the government is now increasing their investigation and prosecution of companies who may have received or used PPP loans improperly. 

[This is the third in a series of blog posts on how businesses should prepare for the California Privacy Rights Act which will enter into force on January 1, 2023]

When the California Privacy Rights Act (“CPRA”) takes effect on January 1, 2023, it will bring changes to several key areas of privacy law.  AALRR has already covered changes regarding (a) employee data here; and (b) data retention requirements here. 

[This is the second in a series of blog posts on how businesses should prepare for the California Privacy Rights Act which will enter into force on January 1, 2023]

When the California Privacy Rights Act (“CPRA”) takes effect on January 1, 2023 it will bring sweeping changes to data retention requirements in California.^[1]  Historically, many companies have over-retained data (and understandably so, since most risks under older laws related to a failure to keep data).  The CPRA changes the data-retention landscape significantly by requiring companies to justify and disclose their retention policies, and to limit retention periods to only the time necessary to fulfill the company’s disclosed purpose for retaining.

[1] Final regulations under the CPRA are still pending and the information provided herein is subject to modification. This guidance also does not cover data retention principles under statutes other than CPRA.

[This is the first in a series of blog posts on how businesses should prepare for the California Privacy Rights Act which will enter into force on January 1, 2023]

Although since January 1, 2020, the California Consumer Privacy Act (“CCPA”) has required covered businesses (as defined below) to provide notice to California employees and job applicants regarding the types of personal information that a business collects, certain key employee exemptions previously limited the privacy-related requirements for employers and corresponding rights of employees and job applicants.  However, those exemptions are set to expire on January 1, 2023.