The California Privacy Protection Agency (CPPA) in charge of implementing and enforcing the California Privacy Rights Act (CPRA) and California Consumer Privacy Act (CCPA) held a series of pre-rulemaking stakeholder sessions over three days last week. Executive Director of the Agency, Ashkan Soltani, opened the sessions on Wednesday, May 4, welcoming those in attendance which included Professor Jennifer Urban, Chair of the Agency. Urban was appointed Chair of the five-person CPPA Board by California Governor Gavin Newsom in March 2021.  

These stakeholder sessions were the third of the Agency’s pre-rulemaking activities. The first activity was an invitation for written comment. The second was a set of pre-rulemaking informational sessions. Speakers for the informational sessions included academics who study relevant topics and officials from the Office of the California Attorney General, the CPPA and the European Data Protection Board.

For this third pre-rulemaking activity, Agency staff and its Board were in “listening mode” as a variety of interested individuals provided verbal comments and suggestions regarding implementing and improving the laws. Commenters included businesses with experience implementing the CCPA, consumers who have exercised their rights under the law, public policy groups and several industry associations.

• Automotive industry stakeholders raised the need for limits to consumers’ ability to opt out of personal data collected by their vehicle, citing vehicle system safety concerns. They questioned whether a consumer’s right to correct data generated by vehicle components and sensors could be effectively exercised and proposed limiting data that can be corrected to personal data provided by the consumer directly to the business.

• Businesses acknowledged their desire to comply with the CCPA, while at the same time expressed frustration with the time and cost involved in implementing provisions of the law that seem likely to change.

• Stakeholders raised concerns around the broad definition of “sale” under the CCPA and CPRA, as well as the need for further guidance on how the Agency and CA Attorney General intend to enforce provisions related to the sale of personal data.

The California Privacy Protection Agency has full administrative power, authority and jurisdiction to implement and enforce the CPRA and California Consumer Privacy Act. The Agency has the power to bring enforcement actions of these laws before an administrative judge, while the California Attorney General holds civil enforcement authority over the laws. This agency is the first in the country dedicated to the protection of data privacy rights.

Agendas, materials and recordings of Agency pre-rulemaking activities can be found here.