Data privacy

California Attorney General Xavier Becerra submitted the final regulations for the enforcement of the California Consumer Privacy Act this week to be approved by the California Office of Administrative Law despite compliance concerns caused by the new coronavirus and ambiguities in those regulations.

The CCPA was passed into law in 2019 and came into effect in January. Becerra indicated that enforcement of the law would begin on July 1. Becerra has published proposed regulations throughout the year and attorneys who are familiar with the law said it is not as clear as they would like it to be.

Michelle Hon Donovan, a partner at Duane Morris in San Diego, said it is still unclear how privacy rights and intellectual property rights will work together. She said if there is not an exception for intellectual property rights, companies could face a situation where an individual or organization claims intellectual property rights over IP that has already been claimed.

"The attorney general is supposed to pass regulations that address exceptions under state and federal laws, including intellectual property rights," Donovan explained. "There is an exception that talks about trade secret rights, but nothing about IP rights."

Reece Hirsch, a partner at Morgan, Lewis & Bockius in San Francisco, said during an interview on Wednesday that one of the ambiguities in the final proposed regulations includes the lack of an opt-out button that was provided in prior versions of the proposed regulations.

Over the next month, Hirsch said companies should make sure they have a CCPA-compliant website privacy notice.

"Similarly, if a business engages in the sale of personal information but does not have a 'do not sell my personal information' link on their website, that is an obvious deficiency," Hirsch said.

He also said companies should check their service provider agreements. Under the regulations, sharing personal information with a service provider constitutes a sale of personal information.

Hirsch said companies would benefit from additional guidance beyond what is in the plain language of the law. He also said he hopes enforcement does not begin July 1, even if it is approved.

"I would hope the attorney general's office would exercise its discretion and not launch into enforcement actions immediately," Hirsch said.

The final regulations were submitted just one month before enforcement is slated to begin. The regulations will need to be approved by the Office of Administrative Law first. The office would normally have 30 workdays to approve the regulation. However, because of the new coronavirus, California Gov. Gavin Newsom allowed the agency an additional 60 calendar days to approve regulations. Hirsch said Becerra has asked that the CCPA be made a priority.

Donovan further explained that any regulations filed June 1 or later will not go into effect until Oct. 1. She said she would expect Becerra to file for an exemption to have the regulations come into effect on July 1.

Companies have previously asked the attorney general to push back the enforcement date to Jan. 1, 2021, citing complications caused by COVID-19. Becerra has expressed that he will not push back the enforcement date of the CCPA.