COVID-19: Companies, Trade Organizations Seek to Postpone CCPA Enforcement Date

Over 30 trade associations and companies co-signed a letter last month to California Attorney General Xavier Becerra asking him to push back the July 1 enforcement date for the California Consumer Privacy Act (CCPA) due to the new coronavirus and a lack of clarity on the enforcement rules.

"The undersigned organizations employ millions of individuals who are faced with this crisis and are doing their best to manage their personal and professional lives in the face of uncertain times. Many companies have instituted mandatory work-from-home measures to limit community," the letter states.

United Parcel Service, Feld Entertainment Inc. and the National Association of Mutual Insurance Companies are among the organizations that signed onto the letter.

An adviser to the attorney general said in an email to Corporate Counsel that the office is "mindful of the new reality created by COVID-19," but said the office still plans on enforcing the rules when they are finalized or on July 1, whichever comes first.

The letter states keeping that date would force companies to consider trade-offs "between decisions that are best for their employees and the world-at-large that may help the organizations they lead avoid costly and resource-intensive enforcement actions."

One issue is that many companies across the country are now requiring their employees to work from home. California Gov. Gavin Newsom ordered all employees to work from home. New York Gov. Andrew Cuomo ordered companies to keep their employees home.

Michelle Hon Donovan, a partner at Duane Morris in San Francisco, said in an interview working from home is going to be a barrier to CCPA compliance.

"The big issue with many of my clients is that they're working from home and they're not as efficient," Donovan said.

Another issue cited in the letter is that companies will not have enough time to process rules because they continue to evolve. So far, Becerra has put out two revisions to the final regulations and has offered additional time for a comment period on those rules.

"It's not clear to me when we're going to see the final rules," Donovan said. "The comment period for the most recent version [didn't] end until March 27."

Donovan further said the last guidance, which was published on March 11, did not have any substantive changes from the first guidance published in January. She said while the employees in the California Office of the Attorney General are working from home, they also will not be at full capacity.

The letter says the third comment period will "delay the ultimate finalization of the rules until at least the end of April 2020, leaving very little time for entities to understand what is required of them under the final regulatory scheme and to build those requirements into their business processes."

*****

Dan Clark covers cybersecurity, legal operations and intellectual property for Cybersecurity Law & Strategy's ALM sibling Corporate Counsel. Follow him on Twitter @Danclarkalm.