Final Rules Implementing CCPA Published
The California Privacy Protection Agency (CPPA) recently published their final rules implementing the California Privacy Rights Act. The rules address a wide range of regulatory topics including data processing agreements, consumer opt-out mechanisms, business-to-business data, disclosures and notices, and data archives and backups. The rules took effect immediately upon approval by the Office of Administrative law on March 29. The CPPA can start enforcing the Act on July 1, 2023.
AFSA’s State Government Affairs team was actively engaged in the rulemaking process. AFSA sent comments to the CPPA on its modified rule text. AFSA also sent letters to the CPPA earlier in the rulemaking process in August 2022 and November 2021.
In addition to the comprehensive rules, the CPPA has started the rulemaking process on future rules governing automated decision-making, cybersecurity audits, and risk assessments. AFSA sent a letter to the CPPA’s request for preliminary comments on these targeted rules.
April 5th, 2023
