Congress lobbied to pre-empt the law
Unprecedented
California has enacted, effective Jan. 1, 2020, the California Consumer Privacy Act (CCPA), a privacy law unprecedented in the U.S. that grants California residents a broad range of European-like privacy rights. Amendments passed on Aug. 31, and awaiting a signature decision by the governor, will (if the bill is signed) extend the time for the California attorney general (CaAG) to promulgate regulations to July 1, 2020, push back enforcement until the earlier of that date or six months from issuance of the regulations, and remove the CaAG's ability to intervene in private lawsuits – all changes made at the request of the CaAG. Fortunately for advertisers and retailers, the CaAG's recommendation that the CCPA's limited private right of action be expanded was rejected, and language was even added to clarify the limits of consumer lawsuits. The U.S. Chamber of Commerce is lobbying Congress to pass a federal omnibus privacy and data protection law that would pre-empt the CCPA and other existing and future state data protection laws. See its proposal and statement here. The Internet Association, a trade group that represents leading internet companies, has also released a proposed framework for federal legislation. More on these efforts is available here.
The Takeaway
Assuming no federal pre-emption, companies need to begin to prepare for the CCPA. To comply with the 12-month look back for consumer requests as of the law's effective date, businesses will need to start data-mapping and record-keeping of personal information (PI) as of Jan. 1, 2019. Since, depending on how long it takes to promulgate the regulations, businesses could get up to a six-month delay in enforcement if the amendment becomes law, a case for waiting to start compliance efforts until Q1 2019 can be made, which may help with budgeting the expense. See our prior post here for how to begin to get ready for the CCPA. In the coming months we will hold a series of seminars on the CCPA and how to build a CCPA compliance program. We will also continue to track efforts to further amend the act, federal legislation that may supplement or pre-empt it, attempts at similar legislation in other states, and the CCPA rule-making process about to be kicked off by the CaAG.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
