Attorneys still concerned about ambiguities in privacy act regulations, attorney general has finalized

Attorney General Xavier Becerra submitted final regulations under the California Consumer Privacy Act on Tuesday, less than a month before he is expected to begin enforcing them. The rules appear to be basically the same as a version circulated in March, but attorneys said they remained concerned about ambiguities.

The lack of significant changes could turn out to be a mixed blessing for companies rushing to comply. On the one hand, anyone who took steps to comply with the March version of the rules won't have to throw out that work. On the other, many attorneys and some in the technology industry said the rules lack sufficient guidance.

"The things that were ambiguous about the regulations before, we're going to have to live with them," said W. Reece Hirsch, who co-heads the privacy and cybersecurity practice at Morgan, Lewis & Bockius LLP.

Hirsch noted the latest version doesn't include the red-lined edits that made previous changes easier to spot. But he pointed to a publication submission form signed by Chief Deputy Attorney General Sean McCluskie on May 29 which indicated there had been no changes since March.

The complaints about insufficient guidance apply, for instance, to a phrase that appears 189 times in just 29 pages of regulations: "personal information." The law, signed in 2018 as AB 375, defined "personal information" in contrast to "publicly available data." Draft regulations released by Becerra's office in February specified that the term applied to data that could be used to identify an individual or household, but that language was stripped out in March.

In an email, Michael A. Hellbusch said this lack of specificity fails to tell companies how, broadly, the regulations could be problematic when companies deal with data that could identify a particular person or internet-connected device.

"Because the final text does not contain any specific guidance, I expect most businesses will be forced to err on the side of caution," said the partner in the intellectual property practice at Rutan & Tucker LLP.

The timing of the rules has also caused a great deal of consternation. The Civil Justice Association of California sent a letter to Becerra in March urging him to delay enforcement of the law until Jan. 1, 2021, in order to allow companies to comply.

"We continue to have major concerns over the potential for unwarranted and unnecessary litigation under the CCPA's private right of action provisions," said Association President Kyla Christoffersen Powell. "Without clear standards, lawsuits and penalties are meaningless hammers ripe for abuse, and businesses may face frivolous lawsuits regardless of the protective steps they take."

"Given the scope and complexity of the CCPA, a time frame of less than 30 days for compliance seems unrealistic for California businesses, especially in light of the current pandemic," said Heather M. Whitehead, a partner with Newmeyer & Dhillon LLP in Newport Beach, in an email. She added that she was still reviewing the regulations.

The news release from Becerra's office announcing the final regulations stated, "The Attorney General can enforce the CCPA beginning on July 1, 2020." It also cited a March executive order from Gov. Gavin Newsom which gives the state's Office of Administrative Law an additional 60 days on top of the normal 30 it has to review the regulations.

But the release also noted the law has technically been in effect all of this year.

"Businesses have had since Jan. 1 to comply with the law, and we are committed to enforcing it starting July 1," Becerra said.