California employers have been given a reprieve on enforcement efforts under the newly enacted California Privacy Rights Act (CPRA) regulations previously set to have taken effect July 1, 2023.

A last-minute ruling on July 3, 2023, by a County of Sacramento Superior Court, has stayed enforcement of the regulations until March 29, 2024. The ruling stems from a challenge to the March 29, 2023 regulations by the California Chamber of Commerce (CalChamber) alleging the newly formed California Privacy Protection Agency (Agency) failed to pass a full set of final regulations in accordance with its stated deadline of July 1, 2022 and therefore could not arbitrarily start enforcement less than one year after passing a set of partial regulations.

Partial Approval

On March 29, 2023 the Agency approved its first set of partial regulations with the Office of Administrative Law approving regulations in twelve of the fifteen areas of regulation contemplated by the California Privacy Rights Act of 2020 (CPRA). The Agency’s enforcement deadline for this first set of regulations was July 1, 2023. It was this shortened enforcement period that prompted CalChamber to file suit.

Focusing on voter intent when passing the CPRA, CalChamber argued that voters “intended for the Agency to issue regulations covering all fifteen mandatory issues by July 1, 2022 thereafter giving businesses one year from the July 2022 adoption date before initiating enforcement efforts. Additional arguments alleged California businesses would also be “unfairly prejudiced” by the Agency’s failure to provide a full twelve-month compliance period. ^[i]

Effectuating Voter Intent

Agreeing with petitioners, and endeavoring to effectuate voters’ intent, the Court found a plain reading of the statute required the Agency to have published a full set of final regulations by July 1, 2022 with enforcement efforts to commence one year later; evidencing voter intent that there be a gap between the passing of final regulations and enforcement.

On the other hand, the Court also agreed with the Agency’s argument that delaying its ability to enforce any violation of the Act for twelve months after the last regulation in a single area had been implemented would likewise thwart voter intent to protect the privacy of Californians.

Striking a balance between these two positions, the Court stayed the Agency’s enforcement of any Agency regulation under the Act’s enforcement provision^[ii] for twelve-months after that individual regulation is implemented.

What does it all mean?

Employers will now have until March 29, 2024 to comply with Agency regulations approved as of July 1, 2023. Subsequently approved regulations must also allow a twelve-month compliance period before enforcement efforts may commence.

For a deep dive into the California privacy laws, Western Growers members are invited to register for the upcoming seminar “CA Privacy Act: What Employers Need to Know about the CPRA/CCPA” on July 19 at 11:00 a.m. PDT, presented by AALRR partners, Regina Silva and Cathy Lee, and WG’s Jason Resnick.

[i] According to Court documents the Court’s finding that the Agency failed to timely pass final regulations as required by the Act was sufficient grounds for the court to rule in Petition’s favor. As a result, the Petitioner’s “unduly prejudiced” argument was not addressed by the Court.

[ii] Cal. Civ. Code § 1798.185, subd. (d).