Calif. Privacy Agency 'Made Mincemeat' of CPRA Implementation Plan: CalChamber

Two weeks before California Privacy Rights Act (CPRA) enforcement, the California Chamber of Commerce (CalChamber) pressed a state court to grant its March 30 petition to delay the date until one year after the California Privacy Protection Agency (CPPA) adopts final rules. “The sole reason for the near nine-month delay in issuing final regulations is the Agency’s conduct,” CalChamber wrote Thursday at California Superior Court in Sacramento (case 2023-80004106-CV).

The CPRA requires enforcement to start July 1, but the agency’s rules weren’t finalized until March 29, even though the ballot initiative that established the law, Proposition 24, contemplated that they would be done by July 1, 2022. The CPPA argued earlier this month that delaying enforcement by 12 months would benefit businesses while hurting consumers and thwarting voters’ will (see 2306070020).

The CPPA "has made mincemeat” of Proposition 24's mandatory implementation schedule, CalChamber said Thursday. The agency didn't "even propose regulations until after the deadline for finalizing them,” it said. Rather than seek an extension of the statutory deadline, the CPPA "instead chose to ignore the deadline and make up for its own delay by substantially shortening the one-year implementation period provided by the voters." The agency didn't even start the rulemaking process until more than nine months after Prop. 24 took effect, it added.

The California privacy agency took nearly two years from its first meeting to adopt a partial set of rules yet wants to give businesses only three months to comply with "new detailed and extensive regulations,” CalChamber said. "That is not reasonable, fair, or compliant with Proposition 24’s express implementation schedule." The agency's "new, revisionist interpretation" of the ballot initiative's deadlines would "yield absurd and internally incoherent results," it added.

The extension sought by the petitioner is specifically tailored to ensure the CPPA follows Proposition 24’s deadlines, said CalChamber. It’s not seeking to curtail rulemaking or enforcement of the 2018 California Consumer Privacy Act. The CCPA’s "consumer protections will remain fully operational and enforceable,” it said.

The petitioner has no plain, speedy or adequate remedy other than seeking mandamus, noted CalChamber. "Petitioner has thoroughly and exhaustively sought to prevent Respondents from shortening the statutory time period available to businesses as a result of the Agency’s delays during the rulemaking process,” said the business group: The agency's "final, unequivocal rejection of these efforts" in its March 29 final statement of reasons "is the recent development that ultimately necessitated the filing of the instant litigation.”

CalChamber needn't show prejudice and the court doesn't have to "balance harms for the central relief requested," but the petitioner "would prevail under either analysis,” it said. "The regulatory record is replete with examples of stakeholder testimony explaining why the Agency’s rushed and unlawful implementation process would cause unnecessary burden and prejudice."