Some California businesses will need to navigate new consumer privacy protections immediately after a Feb. 9 Third District Court of Appeals ruling overturned a lower court’s order.
At issue is the California Consumer Privacy Act, approved by the Legislature in 2018 mandating businesses disclose to consumers when their personal information is stored and to allow individuals to block them from selling their data.
The act was amended in November 2020 with the voter-approved Proposition 24 which increased penalties for violations, limited the use of revenues for certain purposes, and established the California Privacy Protection Agency to enforce data protection laws.
But the California Chamber of Commerce filed a lawsuit in March 2023 against the changes made by Prop. 24, saying a delay from their intended July 2023 implementation was needed due to the lengthy time it took for the agency to approve the new rules and Prop. 24 mandated businesses be given a one-year grace period to change their practices.
A Superior Court agreed in a June 2023 ruling, which then set the date of implementation for March 2024.
But citing voter intent, the appeals court rejected the lower court’s ruling and now the changes are effective immediately.
In its ruling, the appeals court found that the chamber did not possess a “clear, present, and beneficial right” to the delay.
Furthermore, the court argued that voters approved the new privacy protections beginning on the date specified by the proposition.
“Had the drafters of the measure and the voters intended to achieve the result advocated by the Chamber and adopted by the trial court, they could have easily done so,” the decision reads.
The ruling now allows the privacy protection agency to immediately implement all approved proposals and to subsequently enforce other regulations as they are affirmed.
“We are pleased with the decision,” Ashkan Soltani, executive director of the California Privacy Protection Agency, said in a press release celebrating the decision. “This ruling ensures all aspects of the regulations adopted by the California Privacy Protection Agency last year are again enforceable, just as the voters intended when they enacted Proposition 24.”
Now that the changes to the act have been upheld on appeal, new privacy rights provided by the proposition include limiting “sensitive” personal information—race, social security number, health data, and account logins and passwords, among other things—limiting sharing, and correcting data.
Representatives for the agency charged with overseeing enforcement said the ruling restores the rights provided by the initiative.
“The California voters didn’t intend for businesses to pick and choose which privacy rights to honor,” Michael Macko, deputy director of enforcement for the agency, said in the press release. “We are pleased that the court has restored our full enforcement authority, and our enforcement team stands ready to take it from here.”
