Rulemaking Authority Transferred to the California Privacy Protection Agency

News:

The new California Privacy Protection Agency began an important new chapter on April 21, 2022, when rulemaking authority under the California Consumer Privacy Act (CCPA) formally transferred to the Agency, pursuant to the CCPA, as provided for by the California Privacy Rights Act of 2020 (CPRA).

On May 5, 2022, the Agency marked another key milestone when the California Office of Administrative Law (OAL), pursuant to Section 100 of OAL’s regulations, approved the transfer of the existing CCPA regulations to Title 11, Division 6, a new division of the California Code of Regulations that is under the jurisdiction of the Agency. While these amendments are non-substantive and merely renumber the existing CCPA regulations, they represent the beginning of the Agency’s rulemaking role.

First adopted in 2018 and effective January 1, 2020, the CCPA provides Californians with key privacy rights, including the right to know the personal information collected about them by businesses, the right to delete that information, and the right to stop its sale. In November 2020, California voters approved Proposition 24, the California Privacy Rights Act, which created the Agency—the first independent data protection authority in the United States—and vested it with the authority to implement and enforce the CCPA.

These milestones mark the Agency’s latest step toward its first formal rulemaking. The Agency began preliminary rulemaking last year, when it collected hundreds of pages of written pre-rulemaking comments from the public. These comments are available here. Last month, the Agency Board held two days of pre-rulemaking Informational Sessions. Transcripts are available here. Earlier this month, the Agency welcomed comments from the public over three days of pre-rulemaking Stakeholder Sessions. Videos are available here.

The Agency will take its next step toward formal rulemaking on May 26, 2022, when its five-member Agency Board is expected to meet to consider a proposed course of action for the upcoming rulemaking process. Information about the meeting is available here. More information about the Section 100 transfer can be found here, which includes an explanatory statement and a chart that explains the renumbering.

The text of the current CCPA regulations is available here.