On June 1, the California Attorney General submitted its final proposed regulations implementing the CCPA to the California Office of Administrative Law (OAL) for its review and approval. The final regulations contain no material changes from the second modified draft regulations issued on March 11, 2020 (which is discussed in our blog post: Round 3: California AG Revises Proposed CCPA Regulations). As such, the most compelling remaining question is when the final regulations will take effect.
Under the OAL review process, the final regulations may not take effect until as late as January 1, 2021. However, the Attorney General requested that the OAL expedite review of the proposed regulations and that they “become effective upon filing with the Secretary of State,” which would occur immediately following the OAL’s review and approval of the regulations. If the OAL grants this request and approves the regulations on an expedited basis, the regulations can still take effect on or before July 1, 2020, as mandated by the CCPA.
California’s Process for Adopting Regulations
Under the California Administrative Procedure Act (APA), the agency promulgating regulations must submit its final regulations to the OAL, along with documentation demonstrating compliance with the APA’s notice and public comment requirements. The OAL then reviews the submission to confirm that the record satisfies the procedural requirements of the APA and reviews the substance of the regulations for compliance with the six substantive APA standards: Authority, Reference, Consistency, Clarity, Nonduplication, and Necessity. If the rulemaking record demonstrates that the agency complied with the APA, OAL will file the final regulation with the Secretary of State. However, if the OAL determines the regulations do not satisfy the APA’s requirements, the OAL can return the regulations to the drafting agency, and give it 120 days to revise the regulations.
Although the APA provides for a period of thirty (30) working days for the OAL’s review of the record, California Governor Gavin Newsom’s Executive Order N-40-20, issued in response to the COVID-19 pandemic, extended the review deadline for an additional sixty (60) calendar days.
OAL guidelines state that regulations will generally become effective on one of four quarterly dates, depending on when they are filed with the Secretary of State:
- January 1 if filed between September 1 and November 30;
- April 1 if filed between December 1 and February 29;
- July 1 if filed between March 1 and May 31; or
- October 1 if filed between June 1 and August 31.
However, the OAL guidelines allow for earlier effective dates where the submitting agency demonstrates good cause.
Timeline for the CCPA Regulations
The Attorney General’s Office submitted the final CCPA regulations on June 1, meaning that if the OAL completed its review within the normal thirty (30) working day period, the regulations would be filed with the Secretary of State during the June 1 to August 31 period, thereby taking effect on October 1, 2020. If the review takes the additional 60 calendar days permitted under Executive Order N-40-20, the regulations could be submitted to the Secretary of State during the September 1 to November 30 period, meaning that the regulations would not take effect until January 1, 2021.
However, the Attorney General has requested that the OAL expedite and complete its review “within 30 business days” and that the regulations become effective upon filing with the Secretary of State. The Attorney General’s written justification cites the CCPA’s July 1 deadline for adopting regulations as the “good cause” necessary to justify the expedited timeline. Notably, the OAL would have to approve the regulations faster than 30 business days after its June 1 receipt of the final regulations for the Attorney General to meet this deadline.
Enforcement Implications
Despite the uncertainty about when the CCPA regulations will take effect, businesses should be prepared for the Attorney General to begin enforcing the CCPA as early as July 1, 2020, as authorized by the CCPA regardless of whether the final regulations have been adopted. Attorney General Becerra stated as much in the press release issued following the submission of the regulations to the OAL: “Businesses have had since January 1 to comply with the law, and we are committed to enforcing it starting July 1.”
In addition, as we have discussed previously, city and county attorneys and private plaintiffs have had CCPA enforcement power since the law took effect on January 1, 2020.
Contributors
