The Attorney General of California last week approved relatively minor changes to the implementing regulations for the CCPA. The AG also announced that it will retain authority to pursue violations of the landmark California law in court despite the pending creation of a privacy enforcement agency for the state.
The regulations released last week were drafted in August and have been held in administrative limbo for final approval. They clarify certain notice requirements for the sale of personal information and for how companies may interact with approved agents making access requests on behalf of consumers. Perhaps most usefully, they provided an approved icon for use by companies providing an opt-out to consumers.
The AG's press release praised "widespread compliance" with the CCPA since it took effect in early 2020, "especially in response to notices to cure" non-compliant behaviors. Finally, the announcement stressed that enforcement of the CCPA remains with the AG's office, although certain responsibilities will be delegated to the new state privacy watchdog approved by voters last fall.
In addition to writing regulations to implement the CCPA, the California Department of Justice enforces the law. Businesses found to be out of compliance with the CCPA receive a ‘notice to cure’ that provides a 30-day window to remedy their noncompliance. Since CCPA enforcement began on July 1, 2020, the Department has seen widespread compliance by companies doing business in California, especially in response to notices to cure.