CPRA Timeline

As a highlight to the great content in the California Privacy Rights Act (CPRA) Resource Center that I helped contribute to, here is the content from the Resource Center regarding the timeline for the rollout of the CPRA.

• December 11th, 2020:  Election Certified.  Under Article II, Section 10(a) of the California Constitution, the measure becomes effective five days later, or December 16, 2020.  However, with several exceptions described below, the measure becomes operative on January 1, 2023.  See Section 31. The following provisions become operative on December 16, 2020:

  • “Employer – Employee exemption” [Section 1798.145(m) and (n)]

    • information collected by businesses about their employees; and information reflecting written or verbal communications or transactions between an employee and their employer or another business, are not subject to CCPA, except for Section 1798.100 (notification) and Section 1798.150 (data breach).  Exemption sunsets 1/1/23 (previously expired 1/1/22) [Section 1798.145(m)(4) and (n)(3).

    • Creation of Consumer Privacy Fund to receive any fines from CCPA, and CPRA/Section 1798.160

      • first offset costs of courts and AG

      • then 91% into a lockbox fund, interest available for general fund; 9% to consumer advocates & law enforcement

      • Creation of California Privacy Protection Agency (CPPA). Section 1798.199.10-1798.199.40

      • FY 2020-2021: $5M appropriated from General Fund to Agency; thereafter, $10M plus inflation.    “The expenditure of funds… shall be subject to the normal administrative review given to other state appropriations.”   See Section 1798.199.95

• March 16, 2021: initial appointments to CPPA Board [within 90 days of effective date] [See Section 1798.199.10(b)].

• Later of July 1, 2021, or 6 months after agency provides notice to the AG that it is prepared to begin rulemaking, rulemaking moves over to the Agency [Section 1798.185(d)].

  • Note that Attorney General civil enforcement of CCPA/CPRA continues indefinitely; agency commences administrative enforcement starting 7/1/23].

• January 1, 2022: only information collected by businesses after this point is required to be available “forever,” i.e. as long as the business keeps the information [Section 31(a)].  Prior to this date, the business is only required to provide the most recent 12 months of personal information collected by the business, to the requesting consumer; after this date, a consumer may request all their information collected by the business, in the possession of the business, going back to 1/1/22.

• July 1, 2022: Section 1798.185(d) provides that final regulations implementing the new provisions of the CPRA have to be adopted by this date.

• January 1, 2023: remaining provisions of CPRA becomes operative.

• January 1, 2023 “employer – employee exemption” disappears [see Section 1798.145(m) and (n)]

• July 1, 2023 civil and administrative enforcement of CPRA can commence.  Agency has administrative enforcement, AG can step in and take over any case, and County DA’s and four big-city City Attorneys can enforce under Business and Professions Code (BPC) Section 17200. 

For more great CPRA content, check out the CPRA Resource Center!