After a long process involving three rounds of modifications, seven preliminary rulemaking statewide events, over 300 letters, four public hearings, submission of over 1,000 public comments, the California Office of the Attorney General (AG) has submitted the final text of regulations (Final Regulations) to the California Office of Administrative Law (OAL) on June 2, 2020.
The text of the Final Regulations largely mirrors the latest proposed regulations that had been released in March 2020. In comparison to the last version, the Final Regulations contain non-substantive edits, including formatting edits and a handful of minor wording tweaks.
When Will Enforcement Start?
The OAL has up to 30 working days and an additional 60 calendar days to determine whether the regulations satisfy the procedural requirements of the Administrative Procedure Act. However, the AG has requested expedited review and requests that the Final Regulations become effective upon filing with the Secretary of State, specifically requesting that the OAL completes its review within 30 business days to align as closely as possible with the CCPA’s July 1, 2020 enforcement date. Once OAL approves, the final regulation will be filed with the Secretary of State and become enforceable by law.
The Takeaway
Businesses that fall under the scope of the CCPA should be prepared for enforcement of both the CCPA and the Final Regulations starting July 1, 2020. This involves finalizing remaining CCPA items, such as making final updates to privacy policies, implementing data subject request procedures, reviewing data security standards, and providing CCPA training for employees.
The California Attorney General’s final submission package can be found in its entirety here.
