California's privacy agency is appealing a
trial judge's decision to delay enforcement of new data regulations until next March.
The delay “is not supported by the law’s text, and frustrates its purpose,” the
California Privacy Protection Agency wrote in a petition filed late Friday with the state Court of Appeal.
The agency added that the California Chamber of Commerce -- which sought the delay --
didn't show that its members were unable to comply with the new regulations.
The petition came one month after Sacramento County Superior Court Judge James Arguelles granted the business
group's request to delay enforcement on the grounds that companies are entitled to a 12-month period between the rules' finalization and enforcement. He ordered the agency to hold off on enforcement
until March 29, 2024 -- 12 months after the rules were promulgated.
The rules implement the Consumer Privacy Rights Act (also known as Proposition 24), which was passed as a ballot initiative
in 2020.
That measure expanded on the 2018 California Privacy Protection Act.
Taken together, the two measures give consumers the right to tell companies not to share or sell their
information for a host of purposes, including online behavioral advertising. Other sections of the Privacy Rights Act deal with topics including cybersecurity and risk assessments.
Earlier
this year, the California business association sued to postpone the regulations' enforcement, arguing that Proposition 24 explicitly required the California Privacy Protection Agency to issue
regulations by July 1, 2022, and provided that enforcement couldn't begin until July 1, 2023.
The business group argued that those dates effectively give companies a 12-month period to comply
with new regulations.
The state Chamber argued that the agency's failure to issue rules until March 29 deprived businesses of the "one-year compliance grace period.”
The
organization added that the new rules “can reasonably be expected to require significant operational work ... which Proposition 24 accounted for by giving businesses a year to
prepare.”
The California Privacy Protection Agency countered that delaying enforcement “would thwart voter intent,” and that the California Chamber had not shown how
businesses would be prejudiced by allowing enforcement to begin in July.
The agency also argued that the rules finalized in March largely mirror regulations that were already in effect under the older California
Privacy Protection Act.
The agency is now asking a state appeals court to vacate Arguelles' order.
Among other arguments, the agency says that while Proposition 24 sets out deadlines
for regulations and compliance, it doesn't explicitly require a one-year grace period.
“The measure does not contain any express language -- much less a clear, unequivocal mandate --
linking enforcement with the promulgation of regulations; it merely provides that enforcement shall not begin until July 1, 2023, and only for violations occurring on or after that date,” the
agency argues.
The agency also argued that the Chamber failed to present “competent evidence” that companies would be harmed by allowing enforcement to begin in July, and that
businesses have been aware of the law's provisions since 2020.
“In reality, businesses dealing heavily in consumers’ personal data ... have known of the law’s new
requirements since 2020, and had over three months to digest the regulations before enforcement was set to begin on July 1, 2023,” the agency wrote.