New California Agency Sets Enforcement Priorities for Privacy

The California Privacy Protection Agency, the agency tasked with enforcing California consumers’ privacy rights, officially took over enforcement responsibility from the state Attorney General’s office in early July.

While a last-minute court ruling has delayed the agency’s enforcement of the most recent regulations implementing the California Consumer Privacy Act, the agency appears to be organizing quickly and poised to make an immediate impact on personal privacy in the Golden State.

The court ruling didn’t involve any specific enforcement action or initiative, but rather the timing of the agency’s enforcement of certain regulations. The ruling doesn’t affect the agency’s enforcement of the CCPA itself or the regulations already adopted by California’s attorney general.

At a public meeting of the agency’s board held on July 14, Deputy Director of Enforcement Michael Macko stressed the court decision doesn’t give businesses a free pass from all enforcement and explained that the agency intends to immediately start enforcing the statute that California voters approved in 2020.

He then outlined three priorities for enforcement:

• Companies’ privacy notices and policies
• Consumers’ right to request deletion of their personal information, which the CCPA guarantees
• Companies’ implementation of consumer access and opt-out requests

Macko explained that these rights and obligations are now firmly established in California law, and businesses subject to the CCPA should be well aware of what the law requires.

Enforcement Plans

First, the agency announced that its online portal for consumer complaints was operational. The complaint form allows California consumers to directly notify the agency if they believe a company is not following the law. Interestingly, although certainly in keeping with the agency’s purpose and theme, the unsworn complaint option does not require the complainant to provide even a name.

Second, the agency described the process it intends to follow when administratively enforcing the CCPA. The process somewhat resembles a Securities and Exchange Commission administrative proceeding.

It requires the agency’s enforcement division to file a Notice of Probable Cause Proceeding, the agency’s legal division to hold a probable cause hearing, the enforcement division to thereafter file an accusation with the Office of Administrative Hearing, and an OAH administrative law judge to hear the matter and propose a decision. At the end, the agency will meet in closed session to decide whether to adopt, amend, or reject the proposed decision.

And third, the agency will focus on growth. Macko said the agency intends to hire three enforcement attorneys, as well as an assistant chief counsel of enforcement, to build out the agency’s enforcement capabilities, including handling what the agency said it expects to be an increased volume of consumer complaints.

With likely a steady stream of alleged CCPA violations coming in through consumer complaints, a motivated deputy director of enforcement, an established administrative process, and increased staff, the agency is poised to hit the ground running.

As promised, the agency wasted little time in announcing its first wide-ranging action after it took the reins. In July, the agency announced a review of data privacy practices by connected vehicle manufacturers and related CV technologies. Features such as location sharing, web-based entertainment, smartphone integration, and cameras are all within the scope of the review, which will focus on the consumer information that companies must collect for these features to function.

Executive Director Ashkan Soltani further said that modern vehicles are “effectively connected computers on wheels” and that the agency intends to make “inquiries into the connected vehicle space to understand how these companies are complying with California law when they collect and use consumers’ data.”

Given the number of companies that could be impacted by such a review, as well as its sheer scale, the agency’s first announced action is ambitious.

Only time will tell how quickly and effectively the agency will actually ramp up its enforcement and how aggressive that enforcement will be. Based on what the agency is doing now, companies covered by California’s wide-ranging consumer privacy laws would be well advised to start paying attention.

This article does not necessarily reflect the opinion of Bloomberg Industry Group, Inc., the publisher of Bloomberg Law and Bloomberg Tax, or its owners.

Author Information

Luke Sosnicki is a litigator and partner in Thompson Coburn’s Los Angeles office who advises on litigation and regulatory risks related to federal and state data privacy laws, including the California Consumer Privacy Act.

Write for Us: Author Guidelines