California’s new privacy protection agency recently issued an invitation for public comments as part of its preliminary rulemaking activities for the California Privacy Rights Act (CPRA). Introduced and passed by ballot initiative in November 2020, CPRA amends and introduces several new concepts to CCPA.

CRPA required the creation of a new administrative entity – the California Privacy Protection Agency (CCPA) – tasked with implementing and enforcing the law separate from the attorney general’s office. Appointed in March, the agency’s five-member board is made up of lawyers and academics.  In advance of the January 1, 2023 effective date, the agency seeks comments on both the new CPRA rules, as well updates to CCPA’s existing rules. While the agency is supposed to issue final CPRA regulations by July 1, 2022 (before the amended law goes into effect), many are skeptical of this timing in light of the process and timing for the CCPA regulations.

In particular, the Agency seeks feedback on the “new and undecided” issues introduced by CPRA, including:

• Processing that presents a significant risks to consumers’ privacy or security

• Cybersecurity audits and risk assessments

• Automated decision-making

• Rights to delete, correct, and to know

• Right to opt-out of selling or sharing of personal information

• Right to limit use and disclosure of sensitive personal information

• Definitions such as “sensitive personal information” and “deidentified” (among others)

Putting it into Practice. Comments are due by November 8, 2021. Tips for submitting effective comments are available here. Public hearings are expected to be heard in Winter/Spring of 2021 – 2022. This invitation for comments is not the same as a proposed rulemaking action. The public will have the opportunity to provide additional comments on proposed regulations or modifications when the agency proceeds with a notice of proposed rulemaking action (expected later this year). The agency’s next board meeting is scheduled for October 18, 2021 at which time we may learn other additional information about this process and expected timelines.