California Appeals Court Allows Immediate Enforcement of CPRA Regulations
On February 9, 2024, a California appellate court reversed a state trial court decision that delayed enforcement of California Privacy Rights Act (CPRA) regulations by one year. The CPRA—an approved ballot initiative that builds on the State’s comprehensive consumer privacy law, the California Consumer Privacy Act—empowers the California Privacy Protection Agency (Agency) to adopt privacy regulations. Previously, a state trial court paused enforcement for most of these regulations until March 29, 2024, but an appellate court has ruled that all final CPRA regulations are immediately enforceable.
Background
In March 2023, after the Agency missed its July 1, 2022, deadline to adopt final CPRA regulations, the California Chamber of Commerce (California Chamber) sued. On June 30, 2023, the California Superior Court for the County of Sacramento (Superior Court) ruled that CPRA regulations could not be enforced until one year after their adoption.
Because the CPRA provides that the Agency must adopt regulations by July 1, 2022, and enforce those regulations beginning July 1, 2023, the Superior Court reasoned that the CPRA implied a mandatory one-year gap between regulatory adoption and enforcement dates. Therefore, the Superior Court enjoined enforcement of the first CPRA regulations, adopted on March 29, 2023, until one year later: March 29, 2024. Additionally, the Superior Court enjoined enforcement of any future regulations until one year after their adoption. In August 2023, the Agency appealed the Superior Court’s decision.
Appellate Court Reversal
In the CPRA proceeding’s latest development, the California Court of Appeal, Third Appellate District (Third Appellate District or Appeals Court) reversed the Superior Court—finding that the statute’s text allows for enforcement of all regulations beginning on July 1, 2023. The Third Appellate District’s decision authorizes enforcement regardless of when the Agency finalizes regulations.
The Appeals Court concluded that the Superior Court “disregard[ed] the Act’s unambiguous provision setting forth a July 1, 2023, date for the commencement of enforcement” and “substitute[ed] an enforcement schedule . . . that was not set forth in the Act.” The Third Appellate District explained that the CPRA text does not include “clear, unequivocal language mandating a one-year delay between approval and enforcement.” Ultimately, the Appeals Court concluded that the Agency did not have a “clear, present, and ministerial duty” to delay final regulation enforcement.
The Third Appellate District’s decision effectively makes all final CPRA regulations enforceable. Although California court decisions typically become final after 30 days, the Third Appellate District made its ruling final immediately.
The Appeals Court instructed the Superior Court to “vacate its order and judgment granting the” year-long delay. The Superior Court must also “enter a new order denying such relief and otherwise considering any non-moot issue concerning the propriety of compelling more prompt development of regulations.” However, any potential further order is effectively ministerial, and the Agency now takes the position that the regulations “are again enforceable.” Further, the court’s holding makes it highly likely that any future CPRA regulations will be enforceable as soon as they are finalized.
* * *
Wiley has a deep and experienced bench of attorneys specializing in privacy compliance. If you have questions, please contact any of the authors on this alert.
