On Friday, March 3, 2023, the California Privacy Protection Agency (CPPA) held a public meeting of its Board of Directors. Although the meeting focused primarily on the agency's budget and various administrative issues such as subcommittee structure and rulemaking processes.
The board also discussed several topics more directly related to businesses subject to the California Privacy Act.
In particular, it emphasized that it would now prioritize enforcement activities even as the agency continues to grow.
This focus on enforcement aligns with other developments highlighting the need for companies to bring their privacy programs into compliance with California privacy laws, such as the impending finalization of California Privacy Rights Act (CPRA) regulations and the California Attorney General's recent investigation into mobile app compliance with the California Consumer Privacy Act (CCPA).
The CPPA's many recent activities (both in terms of rulemaking and public board meetings) indicate that the agency may be looking to make a splash sooner than expected with respect to the exercise of its enforcement authority.
Companies that had been delaying their CPRA compliance programs should take note of this development as soon as possible.
As a reminder, the California Consumer Privacy Act (CCPA) is a California, U.S. law that gives California consumers additional privacy rights. This law goes into effect in 2020, and gives California consumers the right to know what personal data is being collected about them, by whom, and how it is being used. Consumers can also request to have that data deleted and not be targeted for targeted ads. Companies must also provide an easy way for consumers to make these requests.
Companies subject to this law must also inform consumers of their privacy rights and must comply with data breach notification requirements. The CCPA is considered one of the strongest privacy laws in the United States.
In November 2020, California went one step further and passed the California Privacy Righs Act (CPRA). This law strengthens data protection, it recognizes new rights for users. The CPRA went into effect on January 1, 2023 for enforcement starting in July.