Judge Halts California Privacy Rule Enforcement Until Next March

California’s first-in-the-nation privacy agency must wait until March 2024 to begin enforcing new regulations governing how businesses collect and use customers’ personal information, a state judge ruled.

The ruling by the California Superior Court in Sacramento blocks the California Privacy Protection Agency from moving ahead with plans to begin enforcement of the rules as early as Saturday. It’s a victory for the California Chamber of Commerce, which sued challenging those enforcement plans, arguing that Golden State businesses wouldn’t have as much time as the law allows for them to prepare.

Judge James P Arguelles held that the underlying law, a voter-approved update known as Proposition 24, included plain language requiring the agency to have final regulations in place by July 1, 2022, with enforcement allowed to begin a year later. The final rules, which outline how businesses should handle consumer requests to exercise their privacy rights and various other compliance standards, weren’t issued until March 29.

“The very inclusion of these dates indicates the voters intended there to be a gap between the passing of final regulations and enforcement of those regulations,” Arguelles wrote Friday in an order granting the Chamber’s petition.

Arguelles rejected a Chamber request to delay enforcement of the underlying Proposition 24 statute.

While the agency asserted it was allowed to begin enforcing its rules as early as Saturday, officials indicated that there would be a slow buildup as it built out its staff. And there were indications that businesses weren’t close to ready: A report released earlier this week by the nonprofit Common Sense Media found that nearly half of products or apps used by families aren’t in compliance with the state privacy rules.

Reaction

Ashkan Soltani, executive director of the CPPA, noted in a statement Friday that Arguelles held that “significant portions” of the privacy protections established by Proposition 24 can be enforced starting Saturday.

“Although we’re disappointed the court granted the Chamber’s request to delay enforcement of portions of the regulations enacted earlier this year, the Agency remains committed to advancing the privacy rights of Californians and will take the appropriate next steps to safeguard the protections Californians overwhelmingly supported at the ballot box,” Soltani said.

CalChamber President and CEO Jennifer Barrera said in a statement issued Friday that the additional compliance time offered “basic fairness” for business owners tasked with meeting the new privacy mandates.

“In passing Proposition 24, voters understood that businesses should be provided time to implement new rules before any enforcement action is taken,” Barrera said.

Nielsen Merksamer Parrinelllo Gross and Leoni LLP represented the CalChamber in its lawsuit.

The case is Cal. Chamber of Commerce v. Cal. Privacy Prot. Agency, Cal. Super. Ct., No. 34-2023-80004106, order issued 6/30/23

— With assistance from Joyce Cutler