Companies across California may have a small window to comply with consumer protection laws

Published on


Human Resource and Compliance departments are scrambling to prepare for changes in California’s consumer protection laws. The California Privacy Rights Act (“CPRA”) goes into full effect on January 1, 2023 which makes a variety of changes to the California Consumer Privacy Act (“CCPA”) that was passed in 2018. Amongst many of the changes, CPRA provides consumers the right to know, modify and delete their information that a business collects. Many of these changes are applicable to information that human resource departments maintain.

With the evolution of these new consumer protection laws, government agencies have been publishing regulations to help guide businesses with compliance. Another thing that came from CPRA was the creation of a new agency, the California Privacy Protection Agency (“CPPA”), to implement and enforce CCPA. CPRA set a deadline for July 1, 2022 for CPPA to publish final regulations regarding the changes to CCPA. This would allow businesses six months to properly put policies in place before the January 1, 2023 effective date for CPRA. However, CPPA officials recently disclosed that they are not on track to meet this deadline.

Since CPRA is a new agency, they do not anticipate that they can conduct formal rulemaking proceedings that will allow them to make their July regulation deadline. Without the regulations by July, businesses are placed in a tight spot to maintain compliance with CCPA. The CPPA board has discussed the possibility of remedies for missing the deadline, which can include a deadline extension, temporary/”emergency” regulations, or a grace period for compliance. However, at this point, there has been no final decision on what would happen if the deadline is missed.

For now, companies that collect information from California residents should direct their compliance and Human Resource departments to review the changes that CPRA lays out and keep an eye out for CPPA’s regulations. For guidance on how your business can be affected by California’s new privacy laws, consult a licensed attorney.