In a mere two weeks, as the ball drops in Times Square, California Attorney General (AG) Xavier Becerra will welcome not only a new decade, but a new era of enforcement under the California Consumer Privacy Act (CCPA).

In a news briefing Monday, AG Becerra shed light on two topics of high interest for many privacy professionals this holiday season:

1. Enforcement priorities, and

2. Plans to finalize the recently released draft regulations.

Enforcement Priorities

The AG made one thing clear – even though the AG’s office will not start bringing enforcement actions until July 1, 2020, his office will enforce violations that occur starting Jan. 1. During the first half of 2020, the AG’s office will keep an eye out for how businesses adjust to the new regime, with extra focus on:

• companies’ who handle large amounts of consumer sensitive, critical data, such as health records and social security numbers; and

• the “opt-in” requirement for parents of children under 13, and from teenagers themselves between 13 and 16 years old.

 In response to concerns from small businesses, Becerra noted he will relax enforcement for smaller companies who make an actual effort to comply, yet equivocally stated “ignorance of the law is not an excuse.”  Thus, those businesses that “stick their head in the stand” and ignore the new law should take note that they could be the subject of any enforcement action in the second half of 2020.

Finalizing Draft Regulations

Despite nearly 1,700 pages of written comments were submitted in relation to the proposed regulations, AG Becerra noted that he does not expect much to change with respect to the proposed regulations set forth by his office earlier in October. “That initial public disclosure of our proposed regs gives everyone a sense of where we think we should go,” Becerra noted.  While his statement could be interpreted as a signal that the AG’s office expects to see businesses implement and incorporate the proposed regulations’ requirements in the new year, since the proposed regulations will not be finalized in time, there is no legal requirement that businesses implement them on Jan. 1, 2020, the effective date of the CCPA.

It may be difficult for the AG’s office to keep too close of an eye on violations during the front half of 2020, since Becerra’s office is simultaneously reviewing and analyzing nearly 200 parties’ comments on the proposed regulations. Ranging from affectionate advocates supporting the rules, to inquisitive skeptics seeking further clarity, and even critical skeptics voicing concern over the language, the comments will be taken into advisement if and when the AG makes any changes to the regulations prior to adoption.  “We’re always going to try to make sure that we refine our laws so that they work for everyone,” Becerra noted. “I am in favor of giving consumers real tools to put in practice their rights.”

The Future of the CCPA Remains Uncertain

Becerra hinted that he is not giving up on a consumer’s private right of action to sue companies for violations of any CCPA provisions. A bill that would have created such right failed earlier this year in the California Legislature. During the conference, Becerra noted other possible enforcement avenues, including empowering district attorneys and city attorneys to bring enforcement actions against businesses.

Becerra made clear that he intends to “…try to help folks understand our interpretation of the law.” Clarifications on important topics like the controversial “sale” provisions are highly anticipated by those working quickly to come into compliance. Several large companies in digital advertising, for example, have already released conflicting interpretations on this provision of the law.  On one hand, some companies have announced that they do not believe the transfer of consumer personal information to retargeting advertisers constitutes a “sale” under the CCPA while others have published changes to their service offerings, implicitly acknowledging the sale of personal information. For businesses relying on these digital advertisers, the path forward is unclear.

As businesses begin their new year afresh, it’s best they keep an eye on Sacramento.  In the first half of 2020, we may see a lot of action on the California data protection front -- final CCPA Regulations, proposed amendments, and perhaps sufficient signatures to put CCPA 2.0 on the November ballot.  Stay tuned.