California Draft Regulations Create a New Privacy Baseline

On May 27, 2022, the newly formed California Privacy Protection Agency Board announced that at its upcoming public meeting on June 8, 2022, there would be discussion of items related to the agency’s rulemaking work. But Agenda Item No. 3 was listed as discussion of a draft of proposed regulations implementing the California Consumer Privacy Act (CCPA), and a draft of the regulations were included in meeting materials. 

This quiet release of the new CCPA draft regulations was a surprise, and the proposed regulations depart dramatically in some areas from other state privacy laws. Even as a bipartisan senate may be reaching consensus on federal privacy legislation that could preempt state law, the draft regulations outline a new privacy baseline for the United States. 

Implementation challenges that jump out include new regulations on contracting requirements for service providers; a fast-tracked form of compliance monitoring that could be costly to many companies; and third-party provisions that would be extended to businesses not only collecting but controlling consumers’ personal information. 

Companies doing business in California will be placed in a difficult position. Some of the more complicated proposed obligations will require significant preparation, planning and budget to implement. Businesses should begin big-picture planning now.