California Attorney General Xavier Becerra announced two new steps in the process of implementing the California Consumer Protection Act (CCPA): a set of amendments to the CCPA’s regulations and appointments to the five-member board of the newly created California Privacy Protection Agency (CPPA). These actions are effective as of March 15, 2021.
The amendment’s to the CCPA’s regulations relate to such issues as an offline notice of the right to opt opt of data collection, guidance on the specifics of online opt-out mechanisms, and guidance on how authorized agent requests are verified. While these are relatively minor tweaks, they represent the second set of amendments to the CCPA’s regulations since the bill took effect January 1, 2020.
The appointments to the CPPA board were announced by Becerra in conjunction with Governor Gavin Newsom, Senate President pro Tempore Toni G. Atkins (D-San Diego), and Assembly Speaker Anthony Rendon (D-Lakewood). Becerra had the following to say about the board: “The California Privacy Protection Agency marks a historic new chapter in data privacy by establishing the first agency in the country dedicated to protecting forty million Californians’ fundamental privacy rights. The CPPA Board will help California residents understand and control their data privacy while holding online businesses accountable.”
The five appointees are John M. Urban, John Christopher Thompson, Angela Sierra, Lydia de la Torre, and Vincent Le. The board will appoint an Executive Director and will be responsible for the administration of the CCPA and its companion law, the California Privacy Rights Act (CPRA). They may serve for no more than 8 years on the board.
It is interesting to note that these actions were among the final ones made by Becerra as California Attorney General. He was confirmed by the United States Senate to be President Joe Biden’s Secretary of Health and Human Services. That these updates in the implementation of the CCPA and CPRA were among the last of his tenure as Attorney General demonstrate the emphasis the California state government puts on consumer data privacy regulations.