California Privacy Protection Agency Regulations Now Active Following Appellate Court Decision

California Privacy Protection Agency Can Now Enforce Privacy Regulations After Appellate Court Ruling

In a major victory for consumer privacy rights, the California Privacy Protection Agency has been given the green light to start enforcing its privacy regulations after a state appellate court overturned a lower court ruling that had previously prevented such action until March.

The decision by California’s Third District Court of Appeal means that the regulations enacted by the first-in-the-nation privacy agency, which were supposed to be enforced starting last July, are now officially active.

The legal battle began in 2023 when the California Chamber of Commerce sued the agency just a day after its initial set of regulations went into effect. The regulations were designed to implement the California Privacy Rights Act, which was approved by voters in 2020 to update the state’s comprehensive privacy law. These regulations outlined how businesses should comply with the new updates, including provisions for correcting personal information and handling sensitive personal data.

The Chamber argued that businesses did not have enough time to comply with the new regulations between their enactment in March 2023 and the start of enforcement in July. A trial court sided with the Chamber, interpreting the privacy law to require a one-year gap between the issuance of new rules and the beginning of enforcement.

However, the appellate court disagreed, stating that there was no explicit language in the law prohibiting the agency from enforcing the regulations immediately. The court noted that the one-year gap could be interpreted in different ways, either as a grace period for businesses to comply or as a time for the agency to prepare for enforcement.

With the court’s ruling, businesses will now need to start implementing the privacy regulations set forth by the agency. Additionally, the agency is working on further regulations related to automated technologies and risk assessments, which could also become enforceable without delay.

Michael Macko, deputy director of enforcement for the California Privacy Protection Agency, expressed satisfaction with the court’s decision, stating, “The California voters didn’t intend for businesses to pick and choose which privacy rights to honor. We are pleased that the court has restored our full enforcement authority, and our enforcement team stands ready to take it from here.”

The case, California Priv. Prot. Agency et al. v. Superior Ct. of Sacramento Cnty., has set a precedent for the enforcement of privacy regulations in California and could have broader implications for privacy rights nationwide.