Last night, the California Privacy Protection Agency (CPPA) published agenda materials for its upcoming meeting on February 3, 2023. The materials include:

  • Proposed final draft regulations implementing the California Privacy Rights Act (CPRA). These do not reflect further changes since the draft regulations that the CPPA put out for a 15-day comment period on November 3, 2022.
  • A draft Final Statement of Reasons, which explains the reasoning behind the changes to the draft rules.
  • An invitation for public comment on preliminary questions for a second wave of rulemaking. These questions focus on potential rulemaking on annual cybersecurity audits, risk assessments, and automated decision-making.

The meeting notice includes discussion and possible adoption of the proposed final regulations. If finalized, the rules are subject to a 30-day review from the California Office of Administrative Law.