Business owners are growing anxious about the timeline to comply with new California Consumer Privacy Act (CCPA) regulations – for good reason. CCPA requires businesses to be in full compliance with the new regulations by July 1 of this year – but there are still no regulations to comply with. For this reason, business owners are hopeful that the Attorney General (AG) is willing to hear them: “We need more time!”
The rushed compliance timeline means that a beauty salon owner who is ready to pay her lawyer to make sure she’s following the rules can’t do it today. It means the real estate agent who is ready to pay her web designer to update her website to follow the new rules can’t do it today. Why? Because there are no regulations to comply with. And each passing day shortens the amount of time that business owners across California will have to adjust to the new rules – increasing the overall costs of compliance in the end. It’s high pressure, but don’t lay blame on the AG just yet – he’s also our only hope!
The California Consumer Privacy Act (CCPA) itself requires the Attorney General (AG) to draft and finalize privacy regulations, and begin enforcing those regulations, by July 1 of this year. No easy task, we get it. But the CCPA’s high pressure timeline is as unfair to our AG as it is to California’s business owners. CCPA deprives the AG of the time he needs to develop a stable and predictable set of regulations. In turn, that makes it extremely costly for small businesses to scramble and get into compliance on such a short deadline. Being that these regulations are brand new, it will take time for lawyers and businesses to digest the law and build compliance into their daily practices.
For this reason, many businesses are asking the AG to find a way to delay enforcement until January 1, 2021. If the AG is willing to hear California business owners on this issue, everyone will benefit from the additional time.
The AG just posted the second draft of regulations on February 10. Currently, the AG is soliciting comments on his second draft regulations through February 25. After this comment period, the AG will go back and review the regulations to decide whether he should incorporate any feedback received through the comments. The AG will then edit the regulations accordingly. Next, the AG must decide whether to open the third draft up for more comments or submit his regulations to the Office of Administrative Law (OAL) for review.
Once submitted to the OAL, the OAL will either reject or approve the regulations. This process generally takes 30 days. If rejected, the AG will have to edit the regulations and resubmit them to the OAL. This process is repeated until the regulations are approved. After approval, the regulations can finally be enforced. All these steps must be completed by July 1, and on that same date, the AG will begin enforcing those new regulations against California business owners.
For obvious reasons, this puts business owners in a difficult spot. If we look at the Americans with Disabilities Act (ADA) as an example, you can see how it takes small business owners time to digest government regulations and adjust their practices to comply. Generally, when sweeping regulations that affect all industries take shape, business owners need some lead-time to get adjusted and follow the rules. But right now, the regulations they need to follow are still not finished.
The only person who has the power to forego enforcement at this stage is the AG himself. Thus, if the AG is willing to work together on this issue, everyone will benefit from delaying enforcement until January 1, 2021.