Data Points: Privacy & Data Security Blog

Last week we wrote about the California Court of Appeals’ February 9^th decision vacating the trial court’s June 2023 order delaying enforcement of the California Privacy Rights Act (“CPRA”).  After that decision, we were left to wonder whether the plaintiff, the California Chamber of Commerce (the “Chamber”), would pursue an appeal. This week we got our answer. On February 20^th the Chamber filed a petition with the California Supreme Court seeking review of the Court of Appeals’ decision.

The Chamber’s petition is unsurprising, given its staunch opposition to enforcement of regulations promulgated by the newly formed California Privacy Protection Agency (the “CPPA”) in March 2023. In its petition, the Chamber argues that enforcement of the CPRA’s final regulations prior to the end of the one year period after they were issued “threatens substantial harm to thousands of California businesses and the consumers they serve.”

While the petition does not request that the Supreme Court stay the Court of Appeals’ decision, it does request “depublication” of the decision. Depublication is a mechanism by which the California Supreme Court may order that a Court of Appeals decision not appear in official California Appellate Reports. However, depublication would not reinstate the original stay on enforcement through March 29, 2024 pending a decision from the Supreme Court.

This back-and-forth has been a source of confusion and anxiety for businesses seeking to comply with CPRA’s requirements. Regardless of the outcome of the Chamber’s appeal, building out a CPRA compliance program now should ease this anxiety. The best defense is a good offense and the CPPA clearly has taken the position that businesses shouldn’t wait for the conclusion of this saga to prepare.