SACRAMENTO, Calif. (Legal Newsline) - California can begin enforcing data privacy regulations under a law voters passed in 2020, an appeals court ruled, rejecting arguments by the California Chamber of Commerce that there should be a one-year delay between the promulgation of new rules and when they can be enforced.
The decision by California’s Third District Court of Appeals reversed a victory for the Chamber at the trial court level, where a judge ruled a one-year period specified in the California Privacy Rights Act of 2020 should apply to rules the state established in March 2023.
California has been steadily increasing the obligations of businesses to protect sensitive consumer data, starting with a constitutional amendment in 1972 enshrining privacy as an inalienable right. Voters approved the California Privacy Protection Act in 2018, giving the Attorney General the power to enforce privacy regulations, and in 2020 passed Proposition 24, a sweeping privacy act modeled upon the European Union’s General Data Protection Regulation law.
Proposition 24 also established the California Privacy Protection Agency, with a mandate to adopt further regulations to allow consumers to control the use of private information and correct it if necessary. The act set a July 2022 deadline for introducing the new regulations but the CPPA didn’t get them through the administrative review process until March 29, 2023 and even then only had rules addressing 12 of the 15 subject matter areas specified in Prop. 24.
The following day, the California Chamber sued, claiming the agency couldn’t enforce any of the rules until all 15 subject matter areas were addressed. It also sought an order enforcing a “one-year grace period” it said was in the original law.
A trial court rejected most of the Chamber’s arguments but agreed the rules enacted in 2023 should only be enforce after a year. The appeals court reversed that ruling, however, in a Feb. 9 opinion by Judge Elena Duarte.
“When, as here, an appellate court is asked to interpret the meaning of a voter- enacted statute, our fundamental task is to ascertain the voters’ intent,” the appeals court said. “The statute does not unambiguously require a one-year gap between approval and enforcement regardless of when the approval occurs, and nothing in the relevant material presented for our review signals that the voters intended such a gap.”
There is no dispute that the Agency failed to comply, the court concluded. But the Chamber only sought compliance nine months after the deadline had passed and then could not point to any specific language in Prop. 24 requiring a one-year delay in enforcement.