Newly-Established California Privacy Protection Agency’s CPRA Rulemaking Update

Newly-Established California Privacy Protection Agency’s CPRA Rulemaking Update

Established by the California Privacy Rights Act (CPRA), the California Privacy Protection Agency (CPPA) has been tasked with completing its rulemaking activities and adopting final regulations by July 1, 2022. To that end, the CPPA kicked off its preliminary rulemaking activities by extending a broad invitation for public comment on “any area on which the [CPPA] has authority to adopt rules” and, specifically, “on new and undecided issues not already covered by the existing CCPA regulations.” The CPRA received significant feedback from California stakeholders and published the submissions on its website. Much of the feedback centered around the subjects that the CPRA specifically called out in its initial invitation (e.g., audits and risk assessments, automated decision making, the right to correct inaccurate information, use of sensitive personal information), but some stakeholders were quick to surface other unresolved issues (e.g., expiring exemption of employee data from the scope of CCPA). We will be closely monitoring the CPRA’s rulemaking activities, along with all privacy-related legislative trends, to stay ahead of the rapidly changing privacy landscape and its impact on the entertainment production industry.