News & Publications

Last week, the Board of the new California Privacy Protection Agency (CPPA) held its inaugural meeting. While the agenda for the nearly daylong meeting included informational presentations to the Board on general topics such as California’s open meeting laws, rulemaking processes, and conflict of interest rules, the meeting also covered agency-specific matters, including the Board’s initial hiring strategy and its plan for conducting business until the agency is fully staffed.

While the Board’s agenda was expansive, there is a great deal of work ahead before the CPPA establishes itself as an fully operational agency. Its most pressing matter appears to be the Board’s need to hire a qualified Executive Director and staff—and fast. With a July 1, 2022, statutory deadline for promulgating regulations, the hiring of an Executive Director will greatly increase the agency’s ability to carry out its preliminarily business of rulemaking and related information gathering.

Here are some high-level takeaways from the meeting:

• The Board did not take official action to provide notice to the California Attorney General that the CPPA would assume rulemaking responsibilities under the California Privacy Rights Act (CPRA). The Board felt that the text of CPRA was unclear about when the Board can—or must—assume rulemaking authority. Compounding this confusion was the lack of agency-specific staff to assist the Board in this determination. Therefore, the Board tabled this matter for the next meeting. (Note: no date has been scheduled for the next meeting yet, but it should take place in about a month.)
• Much of the day’s discussion centered on the plan to finalize initial regulations by July 2022. Counsel at the meeting advised that the goal for the Board should be to submit a final regulatory package by May 2022 to ensure the regulations can go into effect by July 1, 2022. Counsel also suggested that the Board provide itself with ample time for rulemaking, as the process involves not just drafting text, but also justifying the regulatory provisions. In this respect, the sooner the Board begins public engagement and drafting regulatory language, the better, including by engaging in pre-rulemaking activities such as soliciting public comment before the officially noticed public comment period begins.
• The Board also approved the formation of three subcommittees, as follows:
• • Rulemaking: This subcommittee, comprised of Chairperson Urban and Board Member de la Torre, will advise the Board on the upcoming rulemaking process, set regulatory priorities, and engage in information gathering.
  • Public Awareness and Guidance: Board Members Thompson and Le will initially work on this subcommittee, which is tasked with promoting public awareness of the risks and harms consumers face regarding their privacy, as well as creating guidance on consumer privacy rights and business duties.
  • Start-up and Administration Subcommittee: This subcommittee will be run by Board Members Sierra and Urban. It will work with other California agencies to understand the administrative issues necessary to build the agency and ensure a successful launch of the CPPA.

As background, in 2018 California became the first state in the U.S. to equip consumers with new privacy tools and new privacy rights under the California Consumer Privacy Act (CCPA). At the November 2020 election, California voters approved Proposition 24, the CPRA, which created the agency. Due to California’s influential status domestically, as well as its massive economy, the agency is posed to become one of the most significant data privacy authorities and regulatory bodies in the world.

The Board includes: Jennifer M. Urban (Chair); John Christopher Thompson; Angela Sierra; Lydia de la Torre; and Vinhcent Lee. The appointed Board members are experts in privacy, technology, and consumer rights, and hail from diverse backgrounds, including academia, private law practice, and nonprofits.

Nielsen Merksamer attorneys specializing in privacy issues continue to closely monitor action by the agency and will provide routine updates pertaining to the agency’s formation and other privacy-related issues. Don’t hesitate to contact your Nielsen Merksamer attorney if you have any questions regarding the new Board, the upcoming rulemaking process, or any related matters. To be sure you receive those updates or to add someone, register here and make sure to check the “California Consumer Privacy Act” box.