CCPA Enforcement by California Attorney General Begins This Month and Related Developments
We want to ensure clients are aware that the enforcement delay of the California Consumer Privacy Act of 2018 (effective January 1, 2020) (the CCPA) recently expired at the end of June. The California Attorney General is expected to begin CCPA enforcement activity this month. Accordingly, businesses should complete their implementation of CCPA compliance measures at the earliest possible opportunity if any applicable compliance measures remain outstanding. As a reminder, the CCPA applies to for-profit entities that (i) collect the personal information of California residents; (ii) determine the purposes and means of processing that information; (iii) do business in California; (iv) and, among other potential triggers, have annual gross revenues in excess of an inflation-adjusted amount of $25 million.
Other CCPA developments and dates that businesses should keep in mind are as follows:
- The California Attorney General has submitted final draft regulations to California’s Office of Administrative Law. Those regulations have not yet been implemented, despite the attorney general’s request for expedited review. However, businesses should expect that the regulations, which can be viewed here, will be implemented in the very near future.
- As discussed in a prior update, the CCPA exceptions for business-to-business information and personnel information, which reduce some CCPA compliance burdens, become inoperative on January 1, 2021. It remains to be seen whether these exceptions will be extended in some manner, so compliance obligations may shift again at the beginning of 2021.
- For businesses subject to the CCPA, compliance obligations could undergo further substantial shifts in the relatively near future. The California Privacy Rights Act, which would significantly expand the CCPA’s existing requirements if enacted, has reportedly obtained enough signatures to appear on the November 2020 ballot in California. If this initiative or something similar is enacted, CCPA-related data privacy requirements will remain a moving target for the foreseeable future.
Visit our COVID-19 Insight Center for our latest legislative and legal updates, articles, and resources.
The material in this publication was created as of the date set forth above and is based on laws, court decisions, administrative rulings, and congressional materials that existed at that time, and should not be construed as legal advice or legal opinions on specific facts. In some cases, the underlying legal information is changing quickly in light of the COVID-19 pandemic. The information in this publication is not intended to create, and the transmission and receipt of it does not constitute, a lawyer-client relationship. Please contact your legal counsel for advice regarding specific situations.