On March 17, 2020, a group of thirty-two trade associations and two corporations formally requested that the California Attorney General (AG) delay enforcement of the California Consumer Privacy Act (CCPA) until January 2, 2021, due to the ongoing COVID-19 pandemic. The trade associations represent leading companies in a wide range of industries, including healthcare and pharmaceuticals, transportation, logistics, advertising, insurance, entertainment, real estate, banking and finance, and technology.

The joint industry letter references the global spread of COVID-19 and notes that the widespread adoption of mandatory work-from-home policies in the United States has affected businesses attempting to achieve CCPA compliance. Specifically, the letter suggests that it may be difficult or impossible to develop and test certain privacy-related systems and processes without on-site employees. Therefore, companies may be forced to choose between employee safety and compliance with the CCPA.

The letter also notes that the CCPA regulations are not yet finalized and argues that, due to the current crisis, the amount of time for businesses to comply with the final regulations is unreasonably short. As we previously discussed, the AG recently issued two rounds of modifications to the proposed regulations. The latest modification notice sets March 27, 2020, as the deadline for written comments, which almost certainly pushes the release of final regulations well into April. The industry letter contends that this leaves insufficient time for companies to analyze and implement the final regulations before they are subject to enforcement, and that the resulting confusion will discourage consumers from utilizing the law’s protections.

The CCPA, in Section 1798.185(c), permits the AG to begin enforcing the statute starting “six months after the publication of the final regulations issued pursuant to this section or July 1, 2020, whichever is sooner.” Because the AG has not yet published final regulations, it may enforce the statute starting on July 1, 2020.

Law.com has reported that an advisor to the AG stated in an e-mail on Friday, March 20, 2020, that the AG had received the industry letter and was “mindful of the new reality created by COVID-19” but still plans to commence enforcement on July 1, 2020.

* * *

We will continue to provide CCPA updates as they become available.