On June 1, 2020, the Office of the California Attorney General submitted its final proposed CCPA regulations to the California Office of Administrative Law (OAL) to review for compliance with the California Administrative Procedures Act.  The text of the final proposed regulations is the same as the second set of modifications, released on March 11 and summarized here.  Accompanying the proposed regulations is a Statement of Reasons setting out modifications from the initial proposed text of the regulations published on October 11, 2019.  If the regulations are approved by OAL, the final text will be filed with the California Secretary of State and will become enforceable. The core provisions of the CCPA became operational on January 1, 2020, and the AG may bring enforcement actions under the CCPA as of July 1, 2020, although it could not premise enforcement actions on its regulations until they are final.

OAL typically has 30 working days to review regulatory changes, but Executive Order N-40-20, issued by Governor Gavin Newsom because of the COVID-19 pandemic, provides OAL an additional 60 calendar days for its reviews.  OAL accordingly has until the end of the first full week of September, to complete its review of the CCPA proposed regulations.  If OAL approves the proposed regulations, the effective date of the regulations would normally be October 1 if filed with the Secretary of State before August 31, or January 1, 2021 if filed after that date, unless the AG demonstrates good cause for an earlier effective date.  And it is possible that OAL could refuse to approve the regulations if it determines that the AG’s process did not comply with the California Administrative Procedures Act, sending them back to the AG’s office for revision.

Noting that the CCPA requires the AG to adopt regulations by July 1, 2020, the AG has requested that, despite the 60-day extension under Executive Order N-40-20, OAL complete its review within 30 business days and that the regulations become effective upon filing with the Secretary of State.  In order to be effective by July 1, 2020 then, OAL must complete its review and filing in fewer than 20 business days from today, and the AG’s request for immediate effectiveness must be granted.

The AG has stated that he is committed to enforcing the CCPA starting July 1, 2020.  It is also possible that the AG will attempt to bring actions against businesses for any alleged CCPA violations that occurred after the law took effect on January 1.  Companies should hone their compliance programs for the anticipated effectiveness of the regulations – which may occur earlier than a month from now – and be aware that the AG will begin enforcement of the CCPA from July 1.