On June 1, 2020, the Office of the California Attorney General (AG) announced it submitted a final CCPA proposed regulations package to the California Office of Administrative Law (OAL). The final proposed regulations package includes no new changes to the second round of modified regulations published on March 11, 2020.

This final proposed regulations package also includes a request for expedited review. Generally, OAL has 30 working days to review and approve proposed regulations. But a California executive order issued in response to Covid-19 now permits OAL to take an additional 60 calendar days if necessary. The AG reasons this expedited review is appropriate given the statutory mandate for regulations. It is true that the CCPA mandates regulations, but it also provides for enforcement to begin on July 1, 2020 with or without finalized regulations in place. Civil Code § 1798.185(c) (“[t]he Attorney General shall not bring an enforcement action under this title until six months after the publication of the final regulations issued pursuant to this section or July 1, 2020, whichever is sooner”) (emphasis added).

To reiterate: even if the regulations are not finalized and enforceable on July 1, 2020, the statute itself will still enforceable beginning July 1, 2020. That makes us wonder – what is it about the regulations that makes the AG so eager to enforce them as soon as statutorily permitted (during an unprecedented period of pandemic and civil unrest)? Who are the intended targets of that early enforcement?

What can we expect moving forward? First, we can expect enforcement to begin on July 1, 2020. This was already expected but the push by the AG to have the regulations made final in an expedited manner reinforces this belief. We can also expect that the regulations will be finalized in the next three months. Businesses subject to the CCPA should be prepared to have the proper processes in place to comply. Enforcement is around the corner and it looks like the AG has been watching. For a refresher on what the final (formerly known as a the second modified) regulations entails, see our blog post, “CCPA Update: Oops, the CA AG Did It Again.”