On February 17, 2022 the California Privacy Protection Agency’s Board (“Board”) met to discuss their progress launching the new agency. They also shared their projected timeline for rulemaking. The California Privacy Protection Agency (CPPA) is the new agency charged with enforcing the California Privacy Rights Act (CPRA).
The big news is that the Board does not expect to meet CPRA’s July 1, 2022 rulemaking deadline. Indeed, Executive Director Soltani anticipated finalizing the regulations sometime in “Q3 or Q4.” That would give companies only weeks to comply with CPRA and its implementing rules. – CPRA goes into effect January 1, 2023. And, even though enforcement is delayed until July 2023, the short time period between finalizing the rules and January 1 will complicate compliance efforts.
Ahead of the rulemaking, the Board plans to hold public hearings in March and April. However, formal rulemaking proceedings will not begin until Q3. The hearings will be conducted online in March, but may be in person starting in April.
Executive Director Soltani also gave an update on the CPPA itself – citing the challenges of setting up and staffing a brand new agency. While the CPPA has made admirable progress, they continue to operationalize not only their ability to enforce CPRA but also the administrative demands of running an agency.
It looks like companies anxious for clarity around CPRA will have to wait a bit longer.