){kind=logo}
The California Privacy Protection Agency (CPPA) held its first board meeting of 2022 on Feb. 17, the sixth board meeting since the agency’s formation on Dec. 16, 2020. The meeting began with board member training provided by the Department of Consumer Affairs. The remainder of the meeting consisted primarily of an agency update provided by Executive Director Ashkan Soltani, including a discussion of the projected timeline surrounding the issuance of the final regulations that would govern the California Privacy Rights Act (CPRA).
Executive Director Soltani began his update with a brief summary of recent steps taken by the CPPA to claim its rulemaking authority. On Oct. 21, 2021, the CPPA gave notice to the California Attorney General that it was prepared to assume rulemaking responsibilities. As such, the agency’s rulemaking authority, under the California Consumer Privacy Act (CCPA), as amended by the CPRA, will transfer from the Attorney General and become effective on April 21, six months after its notice to the Attorney General. Until the agency’s rulemaking authority becomes effective, the agency can only engage in an informal rulemaking process consisting of preliminary information gathering.
As part of the agency’s effort to engage in substantive information gathering, in mid-to-late March it will hold informational hearings featuring various experts and academics who will provide substantive background information to the board and the public on technical and substantive issues related to the CPRA. In April, the agency will hold stakeholder informational sessions that will provide stakeholders with an opportunity to offer their input in an informational hearing format rather than in writing.
The board and agency staff will conduct formal proceedings for its formal rulemaking package in Q2; this is expected to continue through Q3. During this time, the board will deliberate on the package and decide what will be part of the formal rulemaking process. In accordance with the Bagley-Keene Open Meeting Act, the public will have the opportunity to see the rulemaking package before it enters the formal rulemaking process, which will consist of a 45-day time period with opportunities for comment. Executive Director Soltani and the CPPA expect to complete the formal rulemaking process in Q3 or Q4 of this year; however, this timing will likely depend on what occurs during the public comment process.
This projected timeline will mean that the agency will not meet the July 1 rulemaking schedule deadline set forth in the CPRA. Executive Director Soltani highlighted that this delay will allow the agency to balance its continued effort to accelerate hiring of CPPA staff with undertaking substantial information gathering to aid the rulemaking process.
The CPPA board intends to make the informational hearings and sessions accessible to the public; therefore, the hearings are likely to be held virtually. Final dates for informational hearings and public sessions are in the process of being determined.
During the public comment portion of the meeting, at least one member of the public asked if the CPPA would consider delaying enforcement in light of the fact that rulemaking likely will not be completed until the end of the year. The board noted that it would take the question under advisement but that it was unable to comment further due to California’s transparency and public participation requirements. Whether the CPPA will delay enforcement therefore remains unclear.
In other California privacy news, the California Attorney General in January filed a nonsubstantive Section 100 regulation that does not materially alter the terms of the regulation, but merely reorders and renumbers the existing text.
Executive Director Soltani began his update with a brief summary of recent steps taken by the CPPA to claim its rulemaking authority. On Oct. 21, 2021, the CPPA gave notice to the California Attorney General that it was prepared to assume rulemaking responsibilities. As such, the agency’s rulemaking authority, under the California Consumer Privacy Act (CCPA), as amended by the CPRA, will transfer from the Attorney General and become effective on April 21, six months after its notice to the Attorney General. Until the agency’s rulemaking authority becomes effective, the agency can only engage in an informal rulemaking process consisting of preliminary information gathering.
As part of the agency’s effort to engage in substantive information gathering, in mid-to-late March it will hold informational hearings featuring various experts and academics who will provide substantive background information to the board and the public on technical and substantive issues related to the CPRA. In April, the agency will hold stakeholder informational sessions that will provide stakeholders with an opportunity to offer their input in an informational hearing format rather than in writing.
The board and agency staff will conduct formal proceedings for its formal rulemaking package in Q2; this is expected to continue through Q3. During this time, the board will deliberate on the package and decide what will be part of the formal rulemaking process. In accordance with the Bagley-Keene Open Meeting Act, the public will have the opportunity to see the rulemaking package before it enters the formal rulemaking process, which will consist of a 45-day time period with opportunities for comment. Executive Director Soltani and the CPPA expect to complete the formal rulemaking process in Q3 or Q4 of this year; however, this timing will likely depend on what occurs during the public comment process.
This projected timeline will mean that the agency will not meet the July 1 rulemaking schedule deadline set forth in the CPRA. Executive Director Soltani highlighted that this delay will allow the agency to balance its continued effort to accelerate hiring of CPPA staff with undertaking substantial information gathering to aid the rulemaking process.
The CPPA board intends to make the informational hearings and sessions accessible to the public; therefore, the hearings are likely to be held virtually. Final dates for informational hearings and public sessions are in the process of being determined.
During the public comment portion of the meeting, at least one member of the public asked if the CPPA would consider delaying enforcement in light of the fact that rulemaking likely will not be completed until the end of the year. The board noted that it would take the question under advisement but that it was unable to comment further due to California’s transparency and public participation requirements. Whether the CPPA will delay enforcement therefore remains unclear.
In other California privacy news, the California Attorney General in January filed a nonsubstantive Section 100 regulation that does not materially alter the terms of the regulation, but merely reorders and renumbers the existing text.
