Major Privacy Law Enforcement Announcements by CPPA and California and Colorado Attorneys General

California Superior Court Stays Some Areas of Enforcement

By now, you have likely heard about the California Superior Court decision delaying enforcement until March 29, 2024, of the California Privacy Protection Agency regulations issued on March 29, 2023. The CPPA’s regulations supplement the California Consumer Privacy Act, and the CPRA amendments, which became effective January 1, 2023. The Court’s June 30 decision delaying enforcement of the new regulations was the result of a challenge brought by the California Chamber of Commerce.

CPPA Deputy Director of Enforcement Responds to Court Decision

At the Friday, July 14 CPPA Board meeting, Michael Macko, the new Deputy Director for Enforcement, made clear that businesses do not get a “free pass from enforcement” as a result of the Court’s decision to delay enforcement of the new CPPA regulations. He reiterated the broad scope of its enforcement powers in effect now and presented the Enforcement division’s priorities.

Expect “Vigorous Enforcement” By the CPPA This Year

Deputy Director Macko stated that we should expect “vigorous enforcement this year” of obligations on the books for several years” to protect the public. He noted the CCPA, as amended, continues to be enforceable as the Court’s decision didn’t delay enforcement of the obligations of the law, which became effective Jan 1, 2023, and enforceable on July 1, 2023. Nor did the Court decision impact enforcement of the original regulations issued by the California Attorney General’s office supplementing the CCPA in its original form prior to amendment.

This means the CPPA and the AG, who share enforcement powers, have the immediate power to enforce both the law, as amended, and the original regulations, just not the March 29, 2023-issued regulations.

CPPA Enforcement Division’s Guiding Principles

Deputy Director Macko noted that the Enforcement division will be guided by the following principles:

• Protect vulnerable populations: children, the elderly, vulnerable or marginalized populations
• “Aggressive enforcement” as violations can be “black and white” but with the use of sound prosecutorial discretion about which cases to bring and when to bring them, taking into consideration:
  • The nature of the harm(s) to consumers
  • Good faith efforts by the business
  • The size and resources of the business

CPPA Enforcement Division’s Enforcement Priorities…

Read The Full Article at Safeguard Privacy

Editor’s Note: Contact info@newportthomson.com if you would like a demo of the Safeguard Privacy platform, designed to give you and your third parties an accurate compliance score against specific laws such as CPRA and PPIPS (Quebec Law 25 for the Private Sector)