Keypoint: The California Attorney General’s office does not currently plan to extend the CCPA’s enforcement deadline but left the door open to reconsider its position as the coronavirus crisis unfolds.
As we previously reported, on March 17, 2020, over thirty trade associations, companies, and organizations sent a letter to California Attorney General Becerra requesting that, in light of the coronavirus crisis and unfinished status of the regulations, he “forebear from enforcing the CCPA until January 2, 2021 so businesses are able to build processes that are in line with the final regulations before they may be subject to enforcement actions for allegedly violating the law’s terms.”
On March 19, 2020, the Attorney General’s office responded, stating that it does not have any current plans to delay enforcement. According to reports in Forbes, the Wall Street Journal and Corporate Counsel, an advisor to the Attorney General sent an email to reporters, stating “Right now, we’re committed to enforcing the law upon finalizing the rules or July 1, whichever comes first . . . . We’re all mindful of the new reality created by COVID-19 and the heightened value of protecting consumers’ privacy online that comes with it. We encourage businesses to be particularly mindful of data security in this time of emergency.”
The use of the phrase “right now” implies that the Attorney General may change his mind as the crisis unfolds. However, the fact that the Attorney General’s office stated that there is a “heightened value” to protecting consumers’ privacy during the crisis suggests that the Attorney General may proceed with the current enforcement deadline because of the crisis.
By way of background, the Attorney General’s office issued its most recent set of modified proposed regulations on March 11, 2020. The deadline to submit written comments is March 27, 2020. Given the upcoming July 1, 2020, enforcement deadline, the Attorney General’s office presumably will issue final regulations in April, leaving businesses with a short 8-10 weeks to drive compliance.
According to guidance published by the Attorney General’s office, the final regulations will be accompanied by the Final Statement of Reasons, in which the Attorney General’s office will summarize and respond to all public comments received, whether oral or written. Given that there have been thousands of pages of written comments as well as numerous public hearings regarding the proposed regulations, the Final Statement of Reasons will be a crucial document to consider when interpreting the final regulations.
The Attorney General will then submit the final rulemaking record to the Office of Administrative Law (OAL). The OAL will have thirty working days to determine whether the record satisfies all procedural requirements of the California Administrative Procedures Act. If approved by the OAL, the final regulations will be filed with the Secretary of State.