By David Zetoony, a Shareholder, and Andrea Maciejewski, an Associate, with Greenberg Traurig LLP in the firm’s Denver, CO office.   

On July 8, 2022, the California Privacy Protection Agency (“CPPA”) released proposed regulations to implement the California Privacy Rights Act (“CPRA”).  The new proposals would dramatically change the existing regulations that apply to organizations that do business in California.

The CPPA is required under California law to analyze the economic impact of new regulations.  The agency reported that the regulations only create three net-new compliance obligations that will cost businesses less than $127.  For comparison the last time privacy regulations were proposed in California, the state estimated compliance obligations would cost businesses $100,000.

The Washington Legal Foundation has reviewed the proposed regulations and the economic analysis that was completed by the CPPA and has found numerous administrative, procedural, and economic irregularities.  Indeed, the proposed regulations include more than 45 compliance obligations that were not disclosed or considered by the agency in its calculation of business impact.  In addition, the agency failed to prepare a full regulatory impact assessment, or to submit that assessment (as required for all new major regulations) to the California Department of Finance for independent and objective review. 

The law firm of Greenberg Traurig LLP has submitted a comment on behalf of WLF that extensively documents the new compliance obligations that the proposed regulations would impose, and highlights the errors the CPPA committed when undertaking the rulemaking.  A copy of that comment can be found here.  WLF requests that the CPPA complete a full, objective, and accurate assessment of the compliance burden tied to their proposal and follow administrative processes for major regulations; once that is complete the CPPA should resubmit the proposed regulations to a new round of 45-day notice-and-comment to allow businesses to submit comments in the context of, and with the benefit of, accurate compliance-cost related information.

We encourage businesses and associations to submit a comment to the CPPA by the deadline of August 23 the agency that the proposed regulations raise new compliance burdens, and requesting that they restart the notice-and-comment period after preparing and providing a full economic analysis to the public.  Sample language for a comment (which can be submitted via email by a business or a trade association) can be found here.