California regulators appear to be moving forward with enforcement of amendments to the California Consumer Privacy Act by the California Privacy Rights Act ("CPRA"), despite a recent court ruling delaying enforcement of CPRA regulations. In the past month, since the amendments to the California Consumer Privacy Act (the "CCPA"), the Cal AG and the California Privacy Protection Agency (the "CPPA") have announced specific areas of focus for enforcement. These announcements come despite a ruling by California Judge James P. Arguelles on June 30 that the CPPA, which was established by the CPRA, had to delay its enforcement of the new CPRA regulations until March 2024.
The decision was in response to a lawsuit filed by the California Chamber of Commerce, which sought to postpone enforcement until a year after regulations covering amendments to the CCPA were finalized. The court agreed with the California Chamber of Commerce that regulations under the law should have been finalized by July 2022 and not on March 29, 2023. The judge ruled in favor of the California Chamber of Commerce, stating that enforcement could only begin a year after these rules were confirmed. In his decision, Judge Arguelles emphasized that the voters' intent was to have a gap between the passing of final regulations and their enforcement to allow sufficient time for businesses to comply.
Sweep of CCPA Compliance in the Employment Context
Undeterred by the decision requiring a delay in enforcement of the CPRA, on July 14, 2023, the Cal AG's office announced an "investigative sweep" to inspect the compliance of large California employers with the CCPA's privacy protections of employee and job applicant personal data ("HR Data"), a mandate that took effect on January 1, 2023. The objective behind this action is to ensure that businesses are properly implementing procedures to safeguard the personal information of their employees. The extension of the CCPA to cover personal information collected in the employment context significantly amplified the CCPA's scope and has not been replicated by other state data privacy laws. The personal information covered here includes personal information collected in the ordinary course of the covered individuals acting in their jobs or applicant capacities at the company, as well as emergency contact information and information required for administering benefits. Businesses are now required to provide privacy policies to California employees and respond to employee rights and requests, including the right to access, correct, delete, opt-out and/or limit the use of sensitive personal information and data portability, with no retaliation for exercising their privacy rights. Similar to other sweeps, the Cal AG's office has sent inquiry letters to the selected companies, requesting information about "how employers are complying with their legal obligations" to protect HR Data. Cal AG Rob Bonta did not specify what was meant by "large" employers or how many companies had been sent inquiry letters.
CPPA Enforcement for Connected Car Space
Not to be left behind, the CPPA has also taken enforcement steps. In its first enforcement effort as the primary independent data privacy regulator in the US, the CPPA has chosen to target personal information collected by connected vehicles. Connected vehicles are increasingly and automatically collecting significant amounts of personal information, from geolocation to smartphones to camera image data. The CPPA seeks to assess compliance by those companies involved in this data collection with the CCPA's notice, disclosure, sale and consumer rights requirements.
Outlook
The AG's office has conducted other investigative sweeps in its active enforcement of the CCPA, including mobile app compliance. Another sweep, investigating online retailers, resulted in the first CCPA settlement action with the beauty products retailer Sephora. This most recent inquiry serves as notice to all California employers that they must implement and monitor compliance with the new HR Data protections as required by the CCPA.
Nonetheless, the actions by the Cal AG and CPPA to press forward with enforcement of the CCPA, despite Judge Arguelles' decision, send a clear signal that the CCPA's regulators do not intend to delay enforcement activity. Indeed, the CPPA and Cal AG recently filed a petition with California's Third District Court of Appeal to overturn Judge James P. Arguelles' decision to impose a delay on CCPA enforcement. As such, businesses that are relying on delayed enforcement in determining when and how to implement CCPA requirements should keep a close eye on this legal battle.
White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.
This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.
© 2023 White & Case LLP
