Constitutional Concerns Remain as CCPA Enforcement Is Set to Begin

When it comes to the California Consumer Privacy Act (CCPA), the day of reckoning is nearly upon us. The California Attorney General (AG) will be able to start enforcing the statute just a few days from now on July 1, 2020. However, as we've discussed previously, the implementing regulations that will define the contours of the CCPA are not yet final. The regulations are currently under review by the California Office of Administrative Law (OAL), which must ensure the rules comply with certain statutory standards before they may become effective.

On June 2, 2020, the AG sent the draft rules to OAL and asked the office to expedite its review so the regulations can go into effect by the CCPA's July 1, 2020 AG enforcement date. Despite this request, communications from OAL indicate it is possible that they may not approve of the rules in time, meaning that companies could be subject to enforcement actions before they have a finalized regulatory regime from which they can develop their compliance processes and strategies for the CCPA.

The challenges surrounding the unfinalized nature of the CCPA's implementing regulations are compounded by legitimate concerns about the legality of the regulations themselves. There are strong arguments to suggest that the AG exceeded his regulatory authority by promulgating rules related to browser signals that cut against the purpose and intent of the opt-out right in the CCPA, contravene the separation of powers doctrine, and thwart due process. Additionally, the regulations impinge on constitutionally protected speech under the First Amendment to the United States Constitution and Article I, Section 2(a) of the California Constitution by impermissibly burdening commercial speech.

On June 24, 2020, ANA sent a letter to California Governor Gavin Newsom, the AG and members of his office, and OAL outlining the constitutional concerns and resubmitting key points we made on these issues in our March comment submission to the AG. For the benefit of industry members and consumers alike, it is critical that these concerns are addressed and rectified before they impose significant adverse impacts on both businesses and consumers.

The situation surrounding the unfinalized and unconstitutional CCPA regulations is further complicated by the significant shock to life and business-as-usual that we have all felt at the hands of the COVID-19 pandemic. As businesses have adjusted to remote work, they have experienced extraordinarily difficult economic realities, as they have struggled to keep their workforces employed and maintain viability.

In response to the outbreak of the pandemic, ANA joined over sixty-five other trade associations, organizations, and companies to submit a letter to the AG asking him to forebear from enforcing the CCPA until January 2nd of next year. This short deferral would give businesses much needed time to implement the regulations once they become final, and it could give industry and relevant government officials time to work out the constitutional problems inherent in the rules. However, the AG has shown no signs of instituting this reasonable enforcement delay, and businesses and consumers have been left to make sense of the scattered state of affairs as a result.

ANA stands ready to assist our members, the business community, and consumers in navigating the exceedingly complex privacy landscape in California as it continues to evolve. The CCPA is the most sweeping privacy law ever put forward in the U.S., and it is critical that its enforcement be carried out in a way that is the least disruptive to legitimate business compliance efforts while meeting all statutory requirements. Unfortunately, presently neither of these fundamental needs are being met.