Superior Court of California Prohibits Enforcing CPRA Regulations Until March 2024

At a Glance

• On March 29, 2023, the California Privacy and Protection Agency finalized regulations in 12 of the 15 areas contemplated by the California Privacy Rights Act of 2020.
• The California Chamber of Commerce sued the Agency, seeking an order compelling it to adopt final regulations for the three remaining areas and to refrain from enforcing all CPRA-implementing regulations until a year after those regulations were adopted.
• The court ruled that the “Agency may begin enforcing those regulations that became final on March 29, 2023 on March 29, 2024.”

On June 30, 2023, the Superior Court of California, County of Sacramento, Judge James Arguelles presiding, issued an order prohibiting the California Privacy and Protection Agency (the Agency) from enforcing regulations implementing the California Privacy Rights Act of 2020 (CPRA or the Act) until a year after those regulations were finalized.

The CPRA tasks the Agency with adopting regulations to implement the Act, providing in relevant part that “[t]he timeline for adopting final regulations required by the [A]ct adding this subdivision shall be July 1, 2022,” and that “[n]otwithstanding any other law, civil and administrative enforcement of the provisions of law added or amended by this [A]ct shall not commence until July 1, 2023.” Ca. Civ. Code § 1798.185(d).

On March 29, 2023, the Agency finalized regulations in 12 of the 15 areas contemplated by the Act. See Ca. Civ. Code § 1798.185(a) (listing the 15 areas). However, the Agency has not finalized regulations in the remaining three areas: cybersecurity audits, risk assessments and automated decision-making technology. See Ca. Civ. Code §§ 1798.185(a)(15)(A), (a)(15)(B), (a)(16). The Agency has publicly stated that it will enforce the 12 finalized regulations, but that it will hold off on enforcing the three that have not been finalized.

The California Chamber of Commerce sued the Agency, seeking an order compelling the Agency to adopt final regulations for the three remaining areas and to refrain from enforcing all CPRA-implementing regulations until a year after those regulations were adopted. The Chamber of Commerce pointed out that “California voters ‘intended for the Agency to issue the complete regulations covering the fifteen mandatory issues by July 1, 2022,’ and that ‘. . . the voters intended business to have one year from the Agency’s adoption of final regulations before the Agency could begin enforcement.’” The Agency responded that “the text of the Act is not so straightforward as to confer a mandatory promulgation deadline of July 1, 2022, nor did the voters intend for impacted businesses to have a 12-month grace period between the Agency’s adoption of all final regulations and their enforcement.”

After issuing a tentative ruling on June 29 and hearing oral argument on June 30, the court sided with the Chamber of Commerce. It reasoned first that “the Act required the Agency to have published final regulations by July 1, 2022” and second that “voters intended for enforcement not to begin for one year following the Agency’s promulgation of final regulations so as to allow sufficient time for affected businesses to become compliant with the regulations.” As a result, the court concluded that “the Agency should be prohibited from enforcing the Act on July 1, 2023 when it failed to pass final regulations by the July 1, 2022 deadline” and stayed “the Agency’s enforcement of any Agency regulation implemented pursuant to Subdivision (d) for 12 months after that individual regulation is implemented.” In short, the court ruled that the “Agency may begin enforcing those regulations that became final on March 29, 2023 on March 29, 2024.”