Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

On June 30, 2023, a Superior Court for the County of Sacramento issued a <a href="https://content.mlex.com/Attachments/2023-06-29_4745C8U6094V3K3O%2fCU_34-2023-80004106-CU-WM-GDS_10a66e19-7726-4167-bfca-5c1591881c5f8.pdf">tentative ruling</a> that both prohibits the California Privacy Protection Agency (CPPA) from enforcing certain California Privacy Rights Act (CPRA) regulations until 2024 and mandates a 12-month grace period between the adoption of future CPRA regulations and their regulatory enforcement. Accordingly, the original California Consumer Privacy Act of 2018 (CCPA) remains in effect until the CPRA regulations enter into force in 2024.

contentpilot/introduction

core/heading

In 2018, California enacted the CCPA, which provides California residents with various data privacy rights and privileges regarding the collection and use of their personal data. The CCPA became operative on January 1, 2020.

core/paragraph

In November 2020, California voters approved <a href="https://www.thompsonhine.com/services/privacy-cybersecurity/california-consumer-privacy-act-compliance/">Proposition 24</a>, also known as the California Privacy Rights Act of 2020 or CPRA. The CPRA established new standards regarding the collection, retention, and use of consumer data and created the CPPA to implement and enforce the law.

The CPRA provides both that “[t]he timeline for adopting final [CPRA] regulations . . . shall be July 1, 2022” and CPRA enforcement “shall not commence until July 1, 2023, and shall apply to violations occurring on or after that date.”

However, California missed its deadline to promulgate CPRA regulations by almost nine months. It was not until March 29, 2023, that the CPPA finalized its first set of <a href="https://www.thompsonhine.com/services/privacy-cybersecurity/california-consumer-privacy-act-compliance/">regulations</a> under the CPRA, and these regulations only addressed 12 of the 15 areas identified in the law that would require implementing regulations (e.g., requirements governing privacy notices, data subject request processes, targeted advertising, and third-party contracting). The three areas in which California has not finalized its regulations concern cybersecurity audits, risk assessments, and automated decision-making technology.

Although the CPPA has publicly stated it will not be enforcing the three regulatory areas that have not been finalized, it intends to enforce the other 12 areas of the CPRA regulations as soon as July 1, 2023.

On March 30, 2023, the California Chamber of Commerce (the Chamber), which represents itself as the largest broad-based business advocacy group in California, sought to enjoin the CPPA from bringing any enforcement actions under the new CPRA regulations until the 12-month “grace period” inferred within the law is satisfied, and a Superior Court for the County of Sacramento agreed.

In short, the Court found that the CPRA’s plain language indicates the CPPA was required to have final regulations in place by July 1, 2022, and allows it to begin enforcement a year later on July 1, 2023. “The very inclusion of these dates,” according to the Court, “indicates the voters intended there to be a gap between the passing of final regulations and enforcement of those regulations.” Accordingly, the Court agreed with the Chamber’s argument that this delay intended “to allow sufficient time for affected businesses to become compliant with the [CPRA] regulations.”

In conclusion, the Court prohibits the CPPA’s enforcement of any CPRA regulation for 12 months after that individual regulation is implemented. This means that the CPRA regulations finalized on March 29, 2023, will not become effective until March 29, 2024.

Accordingly, based on the plain language of the CPRA, the CCPA remains in effect and is enforceable against businesses until the CPRA regulations enter into force in 2024.

https://admin.thompsonhine.com/wp-content/uploads/2023/07/California-Privacy-Law-Enforcement-Delayed-Until-2024.pdf

California Privacy Law Enforcement Delayed Until 2024

Services