California’s new data privacy law won’t take effect until March 29, 2024 after a superior court judge Friday ruled the California Privacy Protection Agency (CPPA) didn’t pass regulations in time.
“The delay is bad news for beleaguered consumers who have already waited too long for these privacy rights and protections,” said Justin Kloczko, privacy advocate at Consumer Watchdog. “Now companies have nine more months to profit off people’s data that should have been protected under the law.”
The ruling comes a day before the CPPA was set to begin enforcement of the state’s landmark California Privacy Rights Act. The California Chamber of Commerce filed a lawsuit arguing the agency broke its own law when it didn’t pass regulations by July 1, 2022. The Chamber, whose members include tech monopolies Google, Amazon and Meta, big banks JP Morgan Chase, and Toyota, said voters intended for there to be a year between final regulations and enforcement, and the judge agreed.
“The plain language of the statute indicates the agency was required to have final regulations in place by July 1, 2022,” ruled Sacramento County Superior Court Judge James Arguelles. He also pointed to the agreed upon enforcement date of July 1, 2023. “The very inclusion of these dates indicates the voters intended there to be a gap between the passing of final regulations and enforcement of those regulations.”
However, regulations weren’t finalized until a few months ago. Twelve of the agency’s regulations were finalized on March 29. Draft regulations for the remaining three areas—automated decision making, risk assessment and cyber security audits—have not been released, meaning those will also likely be delayed.
“The agency has not indicated any timeline by which it plans to enforce the law in these remaining three areas,” ruled the judge. “As stated, the agency could plan to begin enforcing final regulations in these areas immediately upon their finalization, giving effected business no time to come into compliance. The court agrees with Petitioner that this would not be in keeping with the voters’ intent.”
The new law gives consumers more bargaining power with regards to business’ use of their personal data. Consumers can prevent the use of sensitive data by first parties, and opt out of the selling or sharing of their sensitive information. Those businesses that buy, receive, or sell the personal information of more than 100,000 Californians, derive more than half of their revenue from selling personal information, or have a revenue of over $25 million, will be subject to the law.
