The California Consumer Privacy Act (“CCPA”) came into effect on January 1, 2020, significantly altering the data privacy landscape for businesses across the nation. Due to the speed with which it was drafted and passed, the law delayed enforcement by the Office of the California Attorney General (the “OAG”) until July 1, 2020, or until the finalization of the OAG’s regulations.[1] As a result, many businesses have been waiting to finalize their compliance procedures to ensure consistency with those regulations, which are still subject to revision.
Businesses, however, are now facing an unprecedented situation relating to the COVID-19 pandemic, and many have had to shut down significant portions of their operations. Privacy professionals have therefore been considering whether a further delay in CCPA enforcement is warranted.
More formally, on March 17, a coalition of 35 advertising groups sent the OAG a letter specifically requesting such a delay. That coalition (joined by 25 additional groups) also sent a revised letter to the OAG on March 20, reiterating the request.
Nonetheless, the OAG has declined the request for any further delay and indicated that it is “committed to enforcing the law upon finalizing the rules or [on] July 1 . . . .” The OAG also suggested that, despite everything else going on, businesses should actually be more cognizant of data privacy and security issues during the pandemic, presumably due to the significant increase in remote working arrangements and an acute shift toward e-commerce.
Accordingly, businesses should continue to update their policies and procedures to comply with the CCPA, even during this difficult period.
