CCPA Draft Regulations: What to Know About Timing and Process
With the new CCPA draft regulations out, you may be wondering—how can I comment? What are the deadlines? When will the draft regulations be finalized and go into effect? This blog post summarizes the process and timing for the CCPA proposed regulations. Businesses should consider filing comments to provide the Attorney General’s Office with insights on the operational and practical effects of some of the regulations as proposed, particularly where there may be unintended consequences and effects that were not sufficiently considered. This blog post also walks through California’s rulemaking process under the California Administrative Procedures Act to provide more insights on the realistic timeframe for when the draft rules are likely to be finalized and go into effect.
CCPA Hearings and Comment Process
Comments are important if businesses are concerned about the proposed draft CCPA regulations. The Attorney General’s Office is required to consider all relevant and timely comments, both written and oral. After the comment period ends, the Attorney General’s Office also must respond to these comments in a document called the “Final Statement of Reasons,” which will explain how the Office modified the proposed regulations to accommodate the comments.
The deadline to submit written comments is December 6, 2019 by 5:00 p.m. (PST). Any interested party, or someone authorized to act on their behalf, may submit written comments regarding the proposed CCPA regulations. This can be done by sending the comments, by email, to [email protected]. Comments also can be submitted in-person at the public hearings, or by mail to:
- Privacy Regulations Coordinator California Office of the Attorney General 300 South Spring Street, First Floor Los Angeles, CA 90013
Expected Timing for the Final Rules?
It depends, but as a practical matter, the earliest they could be finalized and effective is likely April 1, 2020 (and that’s if there are no substantive changes made).
In response to the comments filed, the Attorney General may decide to make changes to the proposed CCPA draft regulations. If only non-substantial changes are made, there is no further notice and comment period. If the changes are substantial but reasonably foreseeable (in light of the initial proposed regulations), there is an additional 15 day notice and comment period required. If there are substantial proposed changes that are not sufficiently related to the original proposed regulations, the Attorney General’s Office will need to repeat the full 45 day notice and comment process (this is less likely to occur).
If the agency relies on new material outside of the initial statement of reasons for the originally proposed draft regulations, it must make this material available for comment for 15 days.
Once the Attorney General’s Office completes its review of all comments on the additional proposed changes, and the notice and comment periods are exhausted, the Office will submit the rule to Office of Administrative Law, which has 30 working days to review the rulemaking record and confirm it is consistent with administrative procedure requirements. If all is in order, that office will file the adopted rules with California’s Secretary of State.
The final CCPA rules’ effective date depends on the date that they are filed with the Secretary of State. For example:
- If filed September 1 - November 30: the effective date is January 1.
- If filed December 1- February 29: the effective date is April 1.
- If filed March 1 – May 31: the effective date is July 1.
- If filed June 1 – August 31: the effective date is October 1.
Our firm will continue to review draft CCPA regulations as we work with clients to develop practical guidance on complying with the CCPA. If you have questions on how the regulations may impact your business, or if you would like our assistance with drafting comments to the regulations, please contact Alysa Hutnik.