California Moves Closer to Finalizing Updated CCPA Regulations and Launching a New Rulemaking for Cybersecurity Audits, Risk Assessments, and Automated Decisionmaking

(This blog post was updated on 2/10/23 to note that the CPPA released an Invitation for Preliminary Comments on Proposed Rulemaking.)

At its February 3 meeting, the California Privacy Protection Agency (CPPA) Board took steps pursuant to the California Privacy Rights Act (CPRA) towards (1) finalizing its updated California Consumer Privacy Act (CCPA) regulations and (2) launching a new rulemaking to develop rules for cybersecurity audits, risk assessments, and automated decisionmaking.

As we previewed in our recent webinar on Staying Ahead of State Privacy Laws, both efforts will add to the already complex, California-specific data privacy framework, with significant impacts for covered businesses. Below, we summarize these updates, which businesses should continue to monitor closely.

Updated CCPA Regulations

Since last year, the CPPA has been working to update the CCPA regulations, with several rounds of informational sessions, drafts, public comments, and meetings. At last week’s meeting, the CPPA Board took an important step in this process: it unanimously passed a motion to adopt and approve a rulemaking package and authorize agency staff to submit the package to the California Office of Administrative Law (OAL) for review and approval before the regulations are finalized.

The draft rulemaking package includes a list of edits and additions to the existing rules, as well as an explanation of the changes to the rules (Final Statement of Reasons). The new changes address the following topics:

• Restrictions on the collection and use of personal data;
• Disclosures to consumers;
• Methods for obtaining consumer consent;
• Privacy policies and notices at collection;
• The rights to opt out of sharing and the processing of sensitive personal information;
• The right to correct;
• The use of opt-out preference signals;
• Service provider and contractor contract requirements;
• Third party contract requirements;
• CPPA investigation and enforcement powers; and
• Additional adjustments to the existing regulations.

Of note, the current draft rules may still be subject to further change and delays before they become effective. The Board’s motion on Friday also authorized agency staff to withdraw the draft rules in full or in part if the regulations merit further Board consideration. The Board’s general counsel explained that OAL may require additional modifications, and that substantive changes would require further agency deliberation and another 15-day comment period.

In terms of timing, the CPRA created a rulemaking deadline of July 1, 2022, but the process has moved at a slower pace. With this latest development, the Board discussed that it expects to be able to submit the final rules package to OAL within the next two weeks, and it noted that OAL review typically takes about 30 business days.

Further Rulemaking Regarding Cyber Audits, Risk Assessments, and Automated Decisionmaking

In addition to general updates to the CCPA rules, the CPRA also tasks the CPPA with promulgating rules on cybersecurity audits, risk assessments, and automated decisionmaking. On February 10, 2023, the CPPA released its Invitation for Preliminary Comments on Proposed Rulemaking, following the Board’s unanimous passage of a motion to move the process forward. The public is invited to provide written comments to the CPPA from February 10, 2023 until March 27, 2023.

This second set of rulemaking topics will likely kick off another flurry of meetings, hearings, and releases of draft regulations, much like the last tranche of regulatory topics.

***

As California’s privacy laws and regulations continue to develop, compliance obligations continue to be a moving target. It is increasingly important for affected companies to track these regulatory developments—as well as emerging legal and regulatory developments in other states—to understand their current and future compliance burdens.

Wiley’s Privacy, Cyber & Data Governance team has helped entities of all sizes from various sectors proactively address risks and address compliance with new privacy laws, including with resources like our U.S. State Privacy Law Guide. To better understand how the latest California updates impact your business, do not hesitate to reach out.