On October 10, the California attorney general released the highly anticipated proposed regulations implementing the California Consumer Privacy Act (CCPA). The CCPA—which was enacted in June 2018 (covered by a Buckley Special Alert), amended in September 2018, amended again in October 2019 (pending Governor Gavin Newsom’s signature), and is currently set to take effect on January 1, 2020 (Infobytes coverage on the amendments available here and here)—directed the California attorney general to issue regulations to further the law’s purpose. The proposed regulations address a variety of topics related to the law, including:

  • How a business should provide disclosures required by the CCPA, such as the notice at collection of personal information, the notice of financial incentive, the privacy policy, and the opt-out notice;
  • The handling of consumer requests made under the CCPA, such as requests to know, requests to delete, and requests to opt-out;
  • Service provider classification and obligations;
  • The process for verifying consumer requests;
  • Training and recordkeeping requirements; and
  • Special requirements related to minors.

The California attorney general will hold four public hearings between December 2 and December 5 on the proposed regulations. Written comments are due by December 6.

Notably, the Notice of Proposed Rulemaking states that “the adoption of these regulations may have a significant, statewide adverse economic impact directly affecting business, including the ability of California businesses to compete with businesses in other states” and requests that the public consider, among other things, different compliance requirements depending on a business’s resources or potential exemptions from the regulatory requirements for businesses when submitting comments on the proposal.

Buckley will follow up with a more detailed summary of the proposed regulations soon.