Overview
On September 23, 2022, the California Privacy Protection Agency (CPPA), in an open meeting, invited the public to listen in and provide comments on the agency’s current agenda. This five-hour meeting was facilitated by Chairperson Jennifer Urban. Based on the comments aired in the meeting, the public and other stakeholders (such as the business community) seemed interested in updates about the delayed California Privacy Rights Act (CPRA) regulations (originally expected in July 2022) and what this delay means for businesses attempting to comply with the January 2023 enforcement date. However, the meeting focused on the rulemaking process, largely covering the roles of Board members, subcommittees, staff and the legislature, and covering preliminary agency matters, such as staffing, budgeting and other similar logistics.
Attendance
Although the total number of attendees was not visible via the webinar format, there seemed to be a large mix of business professionals, advocacy groups and individuals speaking in their personal capacity. There were less than 10 commenters, and about three commented on the delayed finalizing of changes and regulations to the CPRA.
Focus
Staffing and growing the agency. The Board appeared pleased with the rapid growth of the agency in its nascent stage, and mentioned hiring an outside consultant through government contracting services to aid in its “strategic planning process.”
The rulemaking process. Board Members Lydia De La Torre and Chris Thompson discussed a “course of action” for the rulemaking process, focusing on the consent calendar, designed to make the process more efficient. However, it appeared that the chair and other members of the Board took issue with the consent calendar, raising potential Bagley-Keene compliance issues. There was also a robust discussion of the role and rules of subcommittees after the formal rulemaking period opens.
The upcoming budget. During the update on the budget for the next fiscal year, the Board discussed its role in the process of making budget change proposals. Under the legislative budget process, budget change proposals are made by the staff and are confidential until approved by the governor. The Board considered whether it should have some oversight over budget change proposals prior to them being submitted to the governor for approval. Some Members were in favor of more oversight and others were satisfied with the current process. While there was no final decision, the Board agreed that further work would be done to determine whether the concerns about lack of oversight could be addressed in a way that is compliant with Bagley-Keene.
Public awareness. Aside from team building and growth strategy, the CPPA is also prioritizing public awareness and education. It recently launched a two-week awareness campaign via banners and radio in English and Spanish. It announced that this reached 112 million people across California, and the CPPA saw an increase in the public’s participation in the rulemaking process, as well as a 300% increase in traffic to its website.
The Board members noted that in engaging with the public, the CPPA had not utilized targeted advertising. There was a brief discussion about whether the CPPA should use targeted ads to more effectively reach the public, or whether it should hold itself “to a higher standard” by abstaining. Chairperson Jennifer Urban commented that it is a government agency and not a company that was selling data, and should therefore be free to use the tools that are available to it within the bounds of the statute.
What now?
Organizations are still left with questions on how to comply with the fast-approaching enforcement date without the regulations. There also appears to be some confusion as to whether the law applies to certain organizations at all. Organizations may visit the CPPA website for more news and resources.
