Privacy.Minded: The CCPA, CPRA and CPPA, a quick refresher…

In 2018, California enacted the California Consumer Privacy Act (CCPA), becoming the first state in the country to pass comprehensive consumer privacy legislation. Following voter approval of Proposition 24 last year, the California Privacy Rights Act (CPRA) enacted a slew of amendments to the CCPA, including creation of the California Privacy Protection Agency (CPPA), which will have broad rulemaking, auditing, investigative and administrative enforcement power.  The agency’s enforcement power will take effect on July 1, 2023. 

The CPRA outlines several steps to occur before 2023 to bring the new agency to life.  The first step, appointment of the inaugural members of its five-person board, was completed this week. 

A ‘new day’ indeed… so who made it onto the board?

The newly appointed board members, whom the CPRA requires be experts “in the areas of privacy, technology, and consumer rights,” include:

1. Jennifer M. Urban, CPPA’s board chair appointed by Governor Newson and a Clinical Professor of Law and Director of Policy Initiatives for the Samuelson Law, Technology and Public Policy Clinic at the University of California, Berkeley School of Law
2. John Christopher Thompson, appointed to the board by Governor Newsom and formerly a senior Vice President of Government Relations at LA 2028
3. Angela Sierra, a designee of Attorney General Xavier Becerra who served as Chief Assistant Attorney General of the Public Rights Division, overseeing 400+ employees with a focus on safeguarding an array of consumer rights
4. Lydia de la Torre, the President Pro Tem’s board nominee and a professor at Santa Clara University Law School, where she has taught privacy law and co-directed the Santa Clara Law Privacy Certificate Program, as well as served as of-counsel to Squire Patton Boggs
5. Vincent Le, the designee of Speaker Anthony Rendon who currently serves as a Technology Equity attorney at the Greenlining Institute with a focus on consumer privacy, closing the digital divide, and preventing algorithmic bias

Governor Newson says board appointments “… represent a new day in online consumer protection and business accountability,” while Senate President pro Tempore Toni Atkins commented that the board “… is part of California’s commitment to the toughest privacy protection laws in the nation.”

The Agency Is Expected To Begin Re-Writing The CCPA’s Implementing Regulations This Year

The board is expected to get to work quickly, starting with the appointment of an executive director and other officers, counsel and employees.  The agency is required to adopt, amend and/or rescind the existing CCPA implementing regulations by the earlier of July 1, 2021, or within six months of notifying the Attorney General that it is prepared to assume rulemaking responsibilities. We’ll be reporting on that activity, which is likely to change significant details of how businesses are expected to comply with the revamped CCPA.