As previewed in a recent post, the California Privacy Protection Agency (“CPPA”) held a public meeting on Thursday, February 17. Notably, the CCPA Board (“the Board”) outlined its authority, explained the authority of the CCPA’s Executive Director, and laid out its nearly year-long going forward plan for rulemaking.  The California Privacy Rights Act (“CPRA”), which substantially amends the existing California Consumer Privacy Act (“CCPA”), becomes effective January 1, 2023.  The CPRA tasked the CPPA, the first data protection authority in the U.S., to fill in a lot of the CPRA’s details through rulemaking by July 1, 2022.  However, based on the timeline presented, we will be lucky to have regulations by the time the CPRA goes into effect.  In its most optimistic estimate the CPPA is shooting for the middle of the 4^th Quarter for final regulations.

The meeting initially began with an informational presentation, which delineated the distinct roles of the CCPA board members and the Executive Director of the California Privacy Protection Agency. The Board members’ chief responsibility is rulemaking. The Board members also are tasked with hiring the CPPA’s Executive Director (which it has already done), setting policy, adopting regulations, overseeing the Executive Director, and resolving enforcement actions. Whereas, the Executive Director is responsible for implementing policy, directing and managing the day-to-day operations of the agency, and representing the Board in the media and public. Both the Board members and the Executive Director work together in drafting agendas and strategic plans.

The first phase of rulemaking, which is currently underway, involves the Board members defining the problem, describing objectives and brainstorming solutions, and listing costs and benefits to potential rules. Next, specific Board committees will draft the proposed regulations, drawing on support from staff and legal counsel. The Board will then approve the language that will become the proposed regulations. The next phase is the staff production phase whereby staff prepares the rulemaking file for filing with the Office of Administrative Law (“OAL”), which is tasked with making sure the proposed regulations are consistent with the underlying statute and the rulemaking authority it grants the CPPA. Upon notice publication, a 45 day public comment period begins. The Board may hold a hearing during this time, but is required to do so only if a hearing is requested.  Any interested person can submit a written request for a hearing to be held, so long as the written request is submitted at least 15 days before the close of the written comment period. After public comment period concludes, the Board must address all adverse comments it received from the public and may notice changes, in which case a new 15 day public comment period is required if changes are material.  This process may be repeated.  Once the CPPA finalizes the proposed text it submits it along with a final rule package to the OAL for review.  More on the CPPA’s rulemaking process is available here.

As to timing, it was announced that preliminary and informational proceedings that will take place on unspecified dates in March and April 2022.  These hearings will precede the formal rule making process in order to help the Board identify issues to consider. The first set of instructive hearings will occur in mid to late March, and will invite comments from academics and experts who will inform questions and issues relating to topics the Board will explore in rulemaking. The second set of hearings will be for the public. The goal of these second hearings is to receive further information from stakeholders on the topics included in the Board’s rulemaking. Information for stakeholders to sign up and participate will be provided at a later date.

In April, directly following these preliminary hearings and drawing upon the information received from these proceedings, the Board will begin engaging in the formal rulemaking process (as described above).  The CPPA anticipates that the rulemaking process, including any formal period public hearings, would commence in the third quarter and continue into the fourth quarter of 2022.  The CCPA acknowledged that this timeline does not comport with the CCPA’s obligation to promulgate regulations by July 1, 2022 as mandated under the CPRA. Regardless, Mr. Solani, along with the Board members, emphasized the importance of the informational preliminary hearings in order to ensure that the rules they adopt adequately address the most prevalent issues in consumer privacy.

Beyond rulemaking, the CPPA also reported on its efforts to build out the agency.  Executive Director Soltani characterized the process as “building the car while driving it.” In addition to Mr. Soltani, the CPPA has hired additional support staff, two Associate Governmental Program Analysts, a law clerk, and is drawing upon staff resources from the Department of Justice. Mr. Soltani is leading the charge in recruiting for many more positions, including a General Counsel (which was discussed in closed session). The agency’s budget, already a part of the governor’s overall budget, will be presented for Board approval at the March 02, 2022 meeting.

So slow to get going, the CPPA is picking up momentum and rulemaking is finally moving forward.