Business Law Journal

In an eleventh-hour ruling made shortly before enforcement of the California Privacy Rights Act’s regulations was set to begin on July 1, a California judge has delayed enforcement until March 29, 2024.  The delay reduces the pressure on businesses who had been facing potential enforcement of unfinalized regulations.  However, the ruling is not a complete reprieve as the delay does not affect enforcement of the statute itself which can still be enforced as of July 1 by both the California Privacy Protection Agency (“CPPA”) and the California Department of Justice.  

[This is the third in a series of blog posts on how businesses should prepare for the California Privacy Rights Act which will enter into force on January 1, 2023]

When the California Privacy Rights Act (“CPRA”) takes effect on January 1, 2023, it will bring changes to several key areas of privacy law.  AALRR has already covered changes regarding (a) employee data here; and (b) data retention requirements here. 

[This is the second in a series of blog posts on how businesses should prepare for the California Privacy Rights Act which will enter into force on January 1, 2023]

When the California Privacy Rights Act (“CPRA”) takes effect on January 1, 2023 it will bring sweeping changes to data retention requirements in California.^[1]  Historically, many companies have over-retained data (and understandably so, since most risks under older laws related to a failure to keep data).  The CPRA changes the data-retention landscape significantly by requiring companies to justify and disclose their retention policies, and to limit retention periods to only the time necessary to fulfill the company’s disclosed purpose for retaining.

[1] Final regulations under the CPRA are still pending and the information provided herein is subject to modification. This guidance also does not cover data retention principles under statutes other than CPRA.

Consumer privacy continues to be an ever evolving and active area of law and California is still leading the way.  In today’s update, we discuss the latest developments in enforcement and litigation for California consumer privacy law. 

The CPRA and the Privacy Protection Agency Inches Closer

The California Privacy Rights Act (CPRA), approved by voters as a ballot proposition in November 2020, supplements and expands the current California Consumer Privacy Act (CCPA), and established the California Privacy Protection Agency (CPPA or the “Agency”), which is vested with full power and authority to enforce the CCPA (including the additional requirements added by the CPRA).  The Agency had already appointed a Board of Directors and been holding regular meetings, but has recently taken additional important steps in its formation. 

Consumer privacy continues to be an ever evolving and active area of law and California is still leading the way. 

New Amendments to the CCPA and the CPRA

Earlier this month Governor Gavin Newsom signed bills into law that amend the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).