?The board of the California Privacy Protection Agency recently held a public meeting focused on the anticipated regulations interpreting the California Consumer Privacy Act, as now amended by the California Privacy Rights Act.
The agency unanimously approved submission of the current set of proposed regulations, which provide clarity on opt-out preference signals, the right to limit the use of sensitive personal information, and new contractual provisions that businesses must include in contracts with service providers that process personal information of California consumers.
As planned, the agency submitted the proposed rules to the California Office of Administrative Law (OAL) on Feb. 14. The OAL has 30 business days to review and consider approval of the proposed regulations.
In its Feb. 3 meeting, the agency unanimously voted to open a public comment period on proposed rulemaking in other areas, including cybersecurity audits, risk assessments, and automated decision-making. The agency’s invitation for public input lists key questions for which the agency is seeking information. Interested parties have until March 27 to submit comments.
The CPRA’s amendments to the CCPA took effect Jan. 1. While the agency’s rulemaking process continues to unfold, businesses should not wait for final regulations to begin compliance efforts. This was reinforced by a press release issued on Jan. 27 by California Attorney General Rob Bonta. The press release announced an investigative sweep of popular apps in the retail, travel, and food service industries that allegedly fail to comply with consumer opt-out requests or offer mechanisms for consumers to opt out of the sale of their data.
John Babione is an attorney with Constangy, Brooks, Smith & Prophete in Indianapolis. Cristina Di Maria is an attorney with Constangy, Brooks, Smith & Prophete in New York City. © 2023. All rights reserved. Reprinted with permission.
