On October 5, 2021, California Governor Gavin Newsom signed into law amendments to the California Consumer Privacy Act (CCPA) via Assembly Bill 694. Businesses are eagerly awaiting clarification on many aspects of the CCPA and the California Privacy Rights Act (CPRA) (the CPRA is set to go into effect on January 1, 2023, with a 12-month look-back period).

However, Assembly Bill 694 does not provide the clarification everyone is awaiting. The bill’s effect is limited to a number of technical and grammatical corrections to the CCPA, which likely will not have material effect on current compliance measures.

The most significant change is the amendment to Section 1798.199.40 which discusses the operations of the California Privacy Protection Agency (CPPA). Assembly Bill 694 clarifies the timeline for when the CPPA must begin its rulemaking process. In the previous version of the CCPA statute, the text contained two contradictory statements. One statement said that that the CPPA had until the later of July 1, 2021, or six months after notifying the Attorney General that it is prepared to assume rulemaking responsibilities to begin the process. The other statement said it was the earlier of the two dates. Assembly Bill 694 clarifies that the agency has until the later of the two dates. Since July 1, 2021 has already passed, this amendment indicates that the new rules will not come out for at least another six months. The timing of the CPPA’s rulemaking authority is very important because it is expected that the CPPA will be very active in implementing new privacy rules.  

* * *

California remains particularly active in regulating privacy, as it has been for a couple of decades, even as the federal government has been unable to enact national legislation. Other recent developments in California include the enactment of the Genetic Information Privacy Act earlier this month.