California’s Attorney General, Xavier Becerra (the AG), has no plans to delay enforcement of the California Consumer Protection Act (CCPA or the Act) during the COVID-19 public health emergency. Although the CCPA went into effect on January 1, 2020, the statute does not authorize enforcement of the Act to begin until July 1, 2020, or six months after publication of the final CCPA regulations, whichever is sooner. Because the final CCPA regulations have not been published at the time of this writing, enforcement of the Act will begin on July 1, 2020.
If the current draft CCPA regulations are submitted for approval to the California Office of Administrative Law (OAL) by May 31, and if the OAL does not choose to extend the approval timeframe by an additional 60 days (as is permitted under California Governor Gavin Newsom’s Executive Order N-40-20 in response to COVID-19), the CCPA regulations could also be approved and enforceable on July 1. If not, the AG will only have authority to enforce the CCPA Act beginning on July 1.
The AG received numerous requests from organizations asking him to defer CCPA enforcement to help relieve the unanticipated pressures currently placed on organizations by COVID-19, including workforces that have been stretched thin and working remotely to comply with state stay-at-home orders. So far, such requests have not persuaded the AG to adjust the CCPA enforcement timeline. In fact, the AG has been encouraging California consumers to enforce their new rights under the CCPA. On April 10, the AG issued a Press Release reminding California consumers of their privacy rights during the COVID-19 emergency, including their rights to: (1) Opt-out of the sale of their personal information (PI) by clicking on website “Do Not Sell My Information” links; (2) Request that businesses delete their PI; and (3) Request that businesses disclose to them what PI the businesses collect, use, share, or sell about them.
To help your organization prepare for CCPA enforcement, you may want to consider the steps set forth in our California Consumer Privacy Act Preparation Checklist.
Keith Geekie, an information analyst with Fey LLC, contributed to this post.