• by Wendy Davis  @wendyndavis, August 7, 2023

California's privacy agency is appealing a trial judge's decision to delay enforcement of new data regulations until next March.

The delay “is not supported by the law’s text, and frustrates its purpose,” the California Privacy Protection Agency wrote in a petition filed late Friday with the state Court of Appeal.

The agency added that the California Chamber of Commerce -- which sought the delay -- didn't show that its members were unable to comply with the new regulations.

The petition came one month after Sacramento County Superior Court Judge James Arguelles granted the business group's request to delay enforcement on the grounds that companies are entitled to a 12-month period between the rules' finalization and enforcement. He ordered the agency to hold off on enforcement until March 29, 2024 -- 12 months after the rules were promulgated.

The rules implement the Consumer Privacy Rights Act (also known as Proposition 24), which was passed as a ballot initiative in 2020.

That measure expanded on the 2018 California Privacy Protection Act.

Taken together, the two measures give consumers the right to tell companies not to share or sell their information for a host of purposes, including online behavioral advertising. Other sections of the Privacy Rights Act deal with topics including cybersecurity and risk assessments.

Earlier this year, the California business association sued to postpone the regulations' enforcement, arguing that Proposition 24 explicitly required the California Privacy Protection Agency to issue regulations by July 1, 2022, and provided that enforcement couldn't begin until July 1, 2023.

The business group argued that those dates effectively give companies a 12-month period to comply with new regulations.

The state Chamber argued that the agency's failure to issue rules until March 29 deprived businesses of the "one-year compliance grace period.”

The organization added that the new rules “can reasonably be expected to require significant operational work ... which Proposition 24 accounted for by giving businesses a year to prepare.”

The California Privacy Protection Agency countered that delaying enforcement “would thwart voter intent,” and that the California Chamber had not shown how businesses would be prejudiced by allowing enforcement to begin in July.

The agency also argued that the rules finalized in March largely mirror regulations that were already in effect under the older California Privacy Protection Act.

The agency is now asking a state appeals court to vacate Arguelles' order.

Among other arguments, the agency says that while Proposition 24 sets out deadlines for regulations and compliance, it doesn't explicitly require a one-year grace period.

“The measure does not contain any express language -- much less a clear, unequivocal mandate -- linking enforcement with the promulgation of regulations; it merely provides that enforcement shall not begin until July 1, 2023, and only for violations occurring on or after that date,” the agency argues.

The agency also argued that the Chamber failed to present “competent evidence” that companies would be harmed by allowing enforcement to begin in July, and that businesses have been aware of the law's provisions since 2020.

“In reality, businesses dealing heavily in consumers’ personal data ... have known of the law’s new requirements since 2020, and had over three months to digest the regulations before enforcement was set to begin on July 1, 2023,” the agency wrote.