Calif. May Implement Privacy Law Late as It Waits Close to Deadline
California may miss the deadline to implement some of the strictest privacy rules of any state. Speculation continued to mount Monday, with any state request to put the rules into place this summer due within hours under standard procedures.
Sign up for a free preview to unlock the rest of this article
Export Compliance Daily combines U.S. export control news, foreign border import regulation and policy developments into a single daily information service that reliably informs its trade professional readers about important current issues affecting their operations.
The state's DOJ hadn’t submitted final rules for implementing the California Consumer Privacy Act to the Office of Administrative Law, an OAL spokesperson emailed hours before a possible Monday deadline to get rules out to the public by July 1. That's when CCPA enforcement begins. Section 11343.4(b)(3) of California government code says how to request an earlier effective date, noted the agency’s representative.
Privacy lawyers said the department would have had to submit rules by Sunday, but because that wasn't a business day, OAL would probably take them Monday. Missing the deadline might mean final rules wait until Oct. 1, three months after Attorney General Xavier Becerra (D) says he will enforce them (see 2005210054). Some attorneys said the section of statute referenced by OLA provides potential ways to still get rules out by July 1.
“The AG could submit the final CCPA regulations late and ask for the July 1 effective date based on ‘good cause,’” Pepper Hamilton’s Sharon Klein emailed. OAL “already has a long list of 55 regulations slated for review, and it is unclear how receptive OAL would be to expediting regulations that (as of the last draft) are nearly 30 pages long,” she said. BakerHostetler attorneys blogged Friday that California law might allow the AG to argue that CCPA is exempt from normal deadline rules because the privacy statute specifies July 1 is the effective date of CCPA regulations.
Wiley’s Joan Stewart didn't see how Becerra can stay on schedule. She emailed that she expects “enforcement in a vacuum come July 1.” CCPA, which took effect Jan. 1, doesn’t require the AG to adopt rules before enforcement begins, said Media Alliance Executive Director Tracy Rosenberg. A delay’s practical effect “is not to render the law moot, but to prevent AG enforcement of the specific areas of CCPA tied into their rule-making until they complete that rule-making,” she emailed.
Becerra’s office didn’t comment.