CCPA Timing Remains Uncertain as California Administrative Office Waits

CCPA enforcement begins. Section 11343.4(b)(3) of California government code says how to request an earlier effective date, noted the agency’s representative. Privacy lawyers said the department would have had to submit rules by Sunday, but because that wasn't a business day, OAL would probably take them Monday. Missing the deadline might mean final rules wait until Oct. 1, three months after Attorney General Xavier Becerra (D) says he will enforce them (see 2005210054). However, some attorneys said the statute section referenced by OLA provides potential ways to get rules out by July 1. “The AG could submit the final CCPA regulations late and ask for the July 1 effective date based on ‘good cause,’” Pepper Hamilton’s Sharon Klein emailed Monday. OAL “already has a long list of 55 regulations slated for review, and it is unclear how receptive OAL would be to expediting regulations that (as of the last draft) are nearly 30 pages long,” she said. BakerHostetler attorneys blogged Friday that California law might allow the AG to argue that CCPA is exempt from normal deadline rules because the privacy statute specifies July 1 is the effective date. Wiley’s Joan Stewart emailed us Friday that she doesn’t see how the AG can stay on schedule and expect “enforcement in a vacuum come July 1.” CCPA, which took effect Jan. 1, doesn’t require the AG to adopt rules before enforcement begins, said Media Alliance Executive Director Tracy Rosenberg. A delay’s practical effect is “to prevent AG enforcement of the specific areas of CCPA tied into their rule-making until they complete that rule-making,” she emailed. “While it is unlikely businesses would be reprimanded for highly technical CCPA violations until the rules are finalized, lack of a good faith effort to comply with the CCPA at all will probably be actionable as of July 1 regardless.” Becerra’s office didn’t comment.