News Stories
Sponsored by Earth Etch. Regulatory insight and compliance solutions for today’s energy markets.
The California Privacy Protection Agency (“CPPA”) Published Notice Of Proposed Rulemaking
The NPRM is focused on the CPPA’s work around “data brokers” and the requirements that data brokers registration requirements. The California Privacy Protection Agency (“CPPA”) published their Notice of Proposed Rulemaking (“NPRM”). The NPRM focus is on the CPPA’s “data brokers” obligating data brokers to register with the CPPA under “Delete Act”.
Public Comment Period July 5 – August 20, 2024, 5:00 p.m. PST.
Notice of Proposed Rulemaking
Text of Proposed Regulation
Initial Statement of Reasons
Data Broker Regulations – Registration Fee – Effective January 1, 2024
As background, the California Privacy Protection Agency implements two laws the California Consumer Privacy Act (2018, 2020) and the Delete Act (2023).
The California Privacy Protection Agency implements two laws the California Consumer Privacy Act (2018, 2020) and the Delete Act (2023).
See: California Consumer Privacy Act | Senate Bill 362 “Delete Act”
1.) The California Consumer Privacy Act
In November 2020, California voters passed Proposition 24, the California Privacy Rights Act (“CPRA”). The CPRA amends and extends the California Consumer Privacy Act of 2018 (“CCPA”). To implement the law, the CPRA established the California Privacy Protection Agency (“Agency”) and vested it with the full administrative power, authority and jurisdiction to implement and enforce the California Consumer Privacy Act of 2018. The Agency’s responsibilities include updating existing regulations and adopting new regulations.
The CCPA (amended by the CPRA) – posted 4/2024
Proposition 24 – Text, includes Findings and Declarations, Purpose and Intent
Proposition 24 – Voter Guide
CCPA Regulations:
California Consumer Privacy Act Regulations – posted 4/2024
Conflict of Interest Code
Completed Rulemaking Activity:
CPPA Pre–Rulemaking Activities on Cybersecurity Audits, Risk Assessments, and Automated Decision making
California Consumer Privacy Act Regulations
Transfer of Rulemaking Authority & New Division for CPPA Regulations
CPPA Pre–Rulemaking Activities
2.) Senate Bill 362 (2023), known as the “Delete Act”
On October 10, 2023, the Governor signed Senate Bill 362 into law. The law tasks the Agency with establishing a deletion mechanism that allows consumers to request from all data brokers the deletion of all non–exempt personal information related to the consumer through a single deletion request to the Agency.
The law also transferred the administration and enforcement of the Data Broker Registry from the Office of the Attorney General to the California Privacy Protection Agency (“Agency”) as of January 1, 2024. The Agency now maintains the Data Broker Registry and posts publicly the required information disclosed by data brokers. The Agency is authorized to promulgate rules to implement the Act.
Senate Bill 362
California Consumer Privacy Act | Senate Bill 362 “Delete Act”
Delete Act Regulations
Data Broker Registration Fee – January 1, 2024
The CPPA’s website has more information on the proposed regulations.
