On March 17, California officials announced the establishment of the five-member inaugural board for the California Privacy Protection Agency (CPPA). The CPPA was established by the California Privacy Rights Act (CPRA), which California voters approved in the November election. The CPPA will take over rulemaking duties from the California Attorney General’s office and will administratively enforce the CPRA. Given that California has the world’s fifth largest economy, the CPPA has the potential to be one of the most important data privacy authorities in the world.

Appointed Board Members

Governor Newsome appointed Jennifer Urban as the Chair of the CPPA. She is a Clinical Professor of Law and Director of Policy Initiatives for the Samuelson Law, Technology and Public Policy Clinic at the University of California, Berkeley – School of Law.

Governor Newsome also appointed John Christopher Thompson as a board member. He is Senior Vice President of Government Relations at LA 2028.

Attorney General Becerra appointed Angela Sierra. She previously served as Chief Assistant Attorney General of the Public Rights Division.

The President Pro Tem of the California Senate appointed Lydia de la Torre, formerly of-counsel at Squire Patton Boggs.

Assembly Speaker Anthony Rendon appointed Vinhcent Le, who currently serves as a Technology Equity attorney at the Greenlining Institute.

Further information as to the background of the appointees can be found here.

Brief Overview of the CPPA

Pursuant to § 1798.199.40(b), the CPPA will assume rulemaking responsibilities from the California Attorney General’s office “on or after the earlier of July 1, 2021, or within six months of the agency providing the Attorney General with notice that it is prepared to assume rulemaking responsibilities.” However, there is contrary language in § 1798.185(d), which states that the CPPA will assume rulemaking “the later of July 1, 2020 or six months after the agency provides notice to the Attorney General that it is prepared to begin rulemaking.”

Whatever the official start date, the CPPA must now adopt final regulations by July 1, 2022, i.e., in the next sixteen months. Further, the CPRA significantly expands the topics upon which regulations must be issued – from seven to twenty-two – and also modifies many of the existing seven topics. For reference, the legislature passed the CCPA on June 28, 2018 (through Assembly Bill 375) and the California Attorney General’s office submitted final regulations on seven topics to the Office of Administrative Law on June 1, 2020–an approximately twenty-three-month time period.

In addition to rulemaking, the CPPA will – eventually – be charged with bringing administrative enforcement actions for violations of the CPRA; however, that authority will not begin until July 1, 2023 and shall only apply to violations occurring after that date.

The CPPA will have a $5 million appropriation for the fiscal year 2020-2021 and a $10 million appropriation every year thereafter.