CPPA gets green light to enforce regulations immediately

Want to receive these weekly privacy recaps in your inbox? Sign up for our privacy newsletter, A Little Privacy, Please.

USA

CPPA gets The Green Light to Enforce Regulations Immediately

A California appellate judge ruled that a trial court erred in prohibiting the California Privacy Protection Agency (CPPA) from enforcing regulations under the California Privacy Rights Act of 2020 until one year after the regulation becomes final.

The appellate court found that there is no express language in the statute mandating a one-year delay, and there is nothing indicating that a one-year delay linking enforcement with the promulgation of regulations was contemplated.

The trial court has therefore been ordered to vacate their judgment staying the Agency’s regulations.

BACKGROUND

Enforcement of regulations issued by the CPPA in March 2023 was originally set to begin July 1, 2023, but a petition by the California Chamber of Commerce to delay such enforcement was granted by a California Superior Court, pushing the enforcement date to March 29, 2024, one year after the regulations were finalized.

The basis for that decision was a provision in the CPRA prohibiting enforcement until July 1, 2023, which “shall apply to violations occurring on or after that date”.

However, the CPRA also required that the CPPA adopt final implementing regulations by July 1, 2022, which deadline the agency missed by almost nine months.

The California Chamber of Commerce argued (and the Superior Court agreed) that giving companies only three months to comply with the regulations did not align with the intent of the legislation.

The Superior Court ruled, therefore, that regulations (both now existing and any that may be implemented in the future) shall not be enforced until twelve months after the given regulations are approved.

Accordingly, the Superior Court ruled that regulations approved in March 2023 could not be enforced until March 2024, and any future regulations approved by the CPPA could not be enforced until twelve months after the date of such approval. 

TAKEAWAY

The Appellate Court decision overturns the earlier Superior Court decision, meaning:

(1) the regulations finalized March 29, 2023 are enforceable immediately; and

(2) any future regulations under the CPRA, including pending regulations regarding risk assessments and automated decision-making, may be enforced immediately upon finalization. 

EUROPE

Dutch DPA Warns of Enhanced Cookie Consent Enforcement

The Dutch Data Protection Authority (AP) posted updated cookie guidance with specific examples accompanied by pictures, along with a warning that “from 2024, the AP will investigate more often how organizations request permission for cookies”.

TAKEAWAY

Among other requirements, the AP’s guidance reminded controllers that consent must be obtained before placing cookies, that one option should not be given more emphasis than another, that separate permission must be obtained for each purpose, that checkboxes should not automatically be enabled, that withdrawing consent should be clear, and that legitimate interest is only possible for functional and limited analytical cookies. 

Want more of the privacy highlights that matter to adtech and martech? Sign up for our privacy newsletter, A Little Privacy, Please.

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.