• by Wendy Davis  @wendyndavis, July 3, 2023

A judge in California has granted a request by the state Chamber of Commerce to delay enforcement of new privacy regulations until March 29, 2024.

The regulations, which were finalized on March 29 of this year, originally were slated for enforcement on July 1, but Sacramento County Superior Court Judge James Arguelles ruled that businesses were entitled to a 12-month period to come into compliance.

The Consumer Privacy Rights Act (also known as Proposition 24), which was passed as a ballot initiative in 2020, expanded on the 2018 California Privacy Protection Act.

Taken together, the two measures give consumers the right to tell companies not to share or sell their information for a host of purposes, including online behavioral advertising. Other sections of the Privacy Rights Act deal with topics including cybersecurity and risk assessments.

Arguelles' ruling, issued Friday, came several months after the California business group sued to postpone enforcement of the new regulations.

The organization, which represents some of the state's largest companies, argued that the Proposition 24 required the California Privacy Protection Agency to issue regulations by July 1, 2022 -- one year before the scheduled enforcement date. 

Instead, the agency adopted partial final regulations on March 29 of this year, leaving businesses with only around three months to come into compliance.

The business group argued that the delay harmed businesses “by depriving them of the one-year compliance grace period.”

The organization added that the new rules “can reasonably be expected to require significant operational work ... which Proposition 24 accounted for by giving businesses a year to prepare.”

The California Privacy Protection Agency unsuccessfully opposed the request, contending that delaying enforcement “would thwart voter intent,” and that the California Chamber hadn't shown how businesses would be prejudiced by allowing enforcement to begin in July.

Among other arguments, the agency argued that the rules finalized in March largely mirror regulations that were already in effect under the older California Privacy Protection Act.

For instance, the agency argued, the new regulations set out procedures for responding to consumers' right to limit the use of sensitive personal information, but those procedures are similar to the ones regarding consumers' right to opt out of the sale of their data.

Proposition 24 gave consumers the right to restrict the use of sensitive data (including information about race, ethnicity, health or finances), while the older California Consumer Privacy Act gave people the right to opt out of the sale or transfer of their data.