As the deadline nears for enforcement of the state’s sweeping new privacy law, a coalition of professional organizations has asked the California Attorney General’s office to delay enforcement due to unforeseen complications caused by COVID-19.
The March 20 letter to Attorney Gen. Xavier Becerra is signed by the Association of National Advertisers, CalChamber, the Civil Justice Association of California (CJAC), and more than 60 other groups.
Their letter asks for a six-month extension to allow for proper implementation of the California Consumer Privacy Act (CCPA) regulations, which have not yet been finalized.
Christoffersen Powell
“The undersigned companies, organizations, and trade associations fully support California’s efforts to provide consumers enhanced privacy protections, but the ever-evolving nature of the CCPA’s proposed rules, especially in light of the current global crisis, makes the current enforcement date of July 1, 2020 a problematic deadline for both businesses and consumers,” the letter states.
The CCPA went into effect Jan. 1, and is now appearing in class action litigation.
After finalizing the regulations, the Attorney General’s office has to submit them for review by the Office of Administrative Law (OAL).
In an email to the Northern California Record, the Attorney General’s press office said, “We are moving swiftly to finalize the CCPA regulations. The AG’s regulations have not yet been submitted to OAL.”
The Notice of Proposed Action for regulations related to CCPA was submitted to the OAL on Oct, 11, 2019, the OAL Reference Attorney told the Record by email. “The agency has a year to finish a rulemaking once the notice is published,” meaning the final regulations must be submitted by Oct. 11, 2020, unless that’s a weekend.
Meanwhile, Becerra has sent a letter to Congress members regarding proposed federal data privacy legislation.
“I hope that your work can be informed by our undertaking in California,” Becerra wrote. “I am optimistic Congress will be able to craft a proposal that guarantees new privacy rights for consumers, includes a meaningful enforcement regime, and respects the good work undertaken by states across the country, looking to state law as providing a floor for privacy protections, rather than a ceiling.”
The CCPA is intended to provide consumers with limits on how companies use their data, and businesses have been working to bring their systems into compliance.
“We need to get this right, and if it takes extra time to get the policy and regulations right to ensure compliance and implementation that benefits consumers, we should take that time at the onset rather than risk unintended consequence,” Kyla Christoffersen Powell, President and CEO of the CJAC told the Record by email.
“The Covid-19 pandemic has only exacerbated the difficulty of complying. We’ve got many workforces that are fragmented and remote right now. Trying to develop new and complicated business procedures to comply with CCPA right now is a nearly impossible task.”
The Attorney General’s office told the Record there are no plans to delay enforcement.
“CCPA has been in effect since January 1, 2020,” the press office said. “We're committed to enforcing the law starting July 1. We encourage businesses to be particularly mindful of data security in this time of emergency.”
Other deadlines have been pushed back in light of the pandemic, Powell said.
“Many systems and deadlines have been postponed in order to accommodate the governor’s stay-at-home directives, and the CCPA implementation shouldn’t be any different,” Powell said.
“If these challenging times necessitate postponing other system deadlines, like Real ID and taxes, then the same should hold true for implementing systems for a complex new law like CCPA.”