California Office of Administrative Law Review Could Impact CCPA Regulations’ Effective Date

Despite the extraordinary almost unprecedented challenges facing our nation and the world due to the dire public health and economic hardships brought on by the COVID-19 pandemic, the California Attorney General (AG) continues to indicate that there will be no delay by his office in the enforcement of the CCPA regulations.

On March 27, 2020, the AG closed a third formal comment period on the content of the draft rules and is now considering comments submitted by ANA and others during that period. It is presently unclear whether or not the AG will issue a third modification to the proposed rules and initiate another public comment period, or finalize the regulations. If the AG decides there are no more changes to be made to the regulations, he will transmit the rules to California’s Office of Administrative Law (OAL), which will review the regulations and then finalize them by filing them with the Secretary of State. The pace at which the OAL completes its statutorily mandated review of the regulations will determine the starting date when the CCPA rules will go into effect.

Under California law, regulations typically go into effect on a quarterly schedule. A drafting agency may, however, request an earlier effective date for regulations by demonstrating good cause for such an earlier date to the OAL. Barring this and other likely inapplicable extenuating circumstances, if the OAL finalizes its review of the CCPA rules by May 31, 2020, the regulations would become effective on July 1, 2020 — the first day the AG may bring enforcement actions under the CCPA. If the OAL finalizes its review at any point from June 1, 2020 through August 31, 2020, the rules would become effective on October 1, 2020, a full three months after enforcement is scheduled to begin. This means that the difference of a mere day in OAL’s review process could have real implications for the CCPA regulations’ effective date. If the OAL completes its review by May 31, 2020, the CCPA rules would become effective much sooner than if the OAL completes that review a day later on June 1, 2020.

The OAL’s review is not a cursory matter of rubber stamping the regulatory scheme. On top of reviewing the regulations to make sure the AG complied with the procedural aspects of California’s Administrative Procedure Act (APA), the OAL also is required to undertake a substantive review of the regulations to ensure that they satisfy at least six statutory standards: (1) necessity, (2) authority, (3) reference, (4) clarity, (5) consistency, and (6) non-duplication. At a basic level, these standards serve to help ensure that regulations further the purposes of their underlying statute, are reasonably clear to those persons directly affected by them, and are in harmony with and not duplicative of other provisions of law. If the OAL determines the regulations do not comport with any of the statutory standards, it can return the regulations back to the drafting agency (in this case, the AG), and give the agency 120 days to revise the rules to bring them in line with the standards.

Under normal circumstances, the OAL by statute has 30 working days to complete its review. However, California Governor Gavin Newsom issued an Executive Order on March 30, 2020 in response to the coronavirus that gives the OAL an additional 60 calendar days to review regulations. As I recently discussed, this timeline extension makes it less likely that the CCPA rulemaking will be finalized before the July 1, 2020 launch date for enforcement. Though ANA and numerous other groups recently joined together to ask the AG to delay CCPA enforcement until January 2021, the AG has not provided any indication he will grant this request. As a result, the business community could be in a very difficult position come July 1, 2020 by either having to comply with a rule that just recently been completed or even worse without the benefit of finalized regulations implementing the CCPA’s terms. Businesses should not be forced to attempt to comply with such an important and complex law under these rushed or incomplete circumstances. This outcome will only confuse consumers and would give businesses little to no time to implement the final legal requirements, thereby causing frustration and severe difficulty for all involved.