Appeals Court Says California Privacy Agency Can Enforce Rules

The California Privacy Protection Agency can start enforcing its privacy regulations after a state appellate court on Friday overturned a lower court ruling that had prevented such action until March.

The decision by California’s Third District Court of Appeal means the regulations that the first-in-the-nation privacy agency had enacted, which were supposed to be enforced starting last July, are now active.

The California Chamber of Commerce sued the agency in 2023, a day after the agency’s first set of regulations went into effect. Those regulations dealt with the basics of the California Privacy Rights Act, which voters approved in 2020 to update the state’s comprehensive privacy law. The regulations detailed how businesses should comply with those updates, such as the right to correct personal information or to deal with the new category of “sensitive” personal information.

The Chamber argued that there was not enough time for businesses to comply between when the first regulations went into effect in late March 2023 and when enforcement began in July. A trial court agreed with the Chamber that language in the privacy law means there should be a year gap for enforcement to begin once new rules are issued.

As a result, businesses didn’t need to immediately comply with those privacy regulations and would have a year to comply after any new privacy regulations were enacted.

However, the appellate court noted there is no “explicit and forceful language mandating that the Agency is prohibited from enforcing the Act until (at least) one year after the Agency approves final regulations,” siding with the agency’s argument. The link between enforcement and the promulgation of regulations is not there, the decision said.

The one-year gap could have been interpreted to allow businesses time to comply, but it could also be interpreted as letting the agency have time to prepare to enforce the new rules, according to the ruling.

Now, businesses will need to begin implementing the privacy regulations enacted by the agency. The agency has also been working on other regulations regarding automated technologies and risk assessments. When those go into effect, they also could become enforceable immediately.

“The California voters didn’t intend for businesses to pick and choose which privacy rights to honor. We are pleased that the court has restored our full enforcement authority, and our enforcement team stands ready to take it from here,” said Michael Macko, deputy director of enforcement for the California Privacy Protection Agency, in a statement.

The case is California Priv. Prot. Agency et al. v. Superior Ct. of Sacramento Cnty., Cal. Ct. App., 3d Dist., No. C099130, opinion 2/9/24