By way of background, in November 2020, California voters approved the CPRA (Proposition 24), the implementing regulations of the California Consumer Privacy Act (CCPA), which called for stringent new standards for companies regarding the collection, retention, and use of consumers’ personal data.
The CPRA further established the California Privacy Protection Agency, tasked with implementing and enforcing the CPRA. The agency was given a deadline of July 1, 2022, to adopt final regulations required by the Act, with enforcement of any violations set to commence a year later.
The agency did not meet its deadline. Ultimately, the first set of CPRA regulations in 12 of the 15 substantive areas under Section 1798.185 took effect on March 29. That left the three remaining areas—cybersecurity audits, risk assessments, and automated decision-making technology—without finalized regulations.
The agency said it would not enforce the CPRA in those areas until the regulations in those areas were finalized—but that it did intend to enforce the law in the other 12 areas, starting July 1.
Lawsuit Filed
On March 30, the California Chamber of Commerce filed a lawsuit in the Superior Court of California County of Sacramento against the agency and the California Attorney General’s office. In its lawsuit, the Chamber of Commerce asked the court to order the agency “to promptly adopt comprehensive, complete, and final regulations” implementing the CPRA and “prohibit any civil or administrative enforcement … until businesses receive the implementation time that the voters approved, 12 months after regulations are adopted.”
“In approving Proposition 24, the voters provided a one-year period for businesses to adjust their practices and comply with the law,” said CalChamber President and CEO Jennifer Barrera. “With an incomplete set of regulations in place and no assurance from the agency that enforcement will be delayed, we were compelled to file this lawsuit to ensure California businesses have time to comply with a complicated set of new regulations. We are simply asking the court to order the agency to adopt final regulations and abide by the timelines for enforcement that were approved by the voters.”
On June 30, Judge Patrick Arguelles found in favor of the CalChamber as it relates to the timing of CPRA enforcement. “The court is not persuaded by the agency’s argument that it may ignore one date while enforcing the other,” the ruling stated.
“Enforcement of any final agency regulation implemented pursuant to Subdivision (d) will be stayed for a period of 12 months from the date that individual regulation becomes final,” the ruling concluded. “The court declines to mandate any specific date by which the agency must finalize regulations.”
The relief that the ruling provides for businesses has no bearing on enforcement of the CCPA, which remains in effect and enforceable until the CPRA provisions become enforceable. 
Jaclyn Jaeger is a contributing editor at Compliance Chief 360° and a freelance business writer based in Manchester, New Hampshire.