State Privacy Enforcement Will Increase, Says Privacy Lawyer

Expect California privacy law enforcement to escalate once the California Privacy Rights Act (CPRA) takes over from the California Consumer Privacy Act (CCPA) on Jan. 1, said Carlton Fields attorney Christina Gagnier on a Tuesday webinar. Enforcement will shift from Attorney General Rob Bonta (D), who already has been more aggressive than predecessors, to the new California Privacy Protection Agency, said the privacy lawyer for businesses. One takeaway from Bonta’s recent $1.2 million action against cosmetics store Sephora under the CCPA (see 2208240067) is that “enforcement is industry agnostic,” said Gagnier. “Any company could be a target.” 2023 will be a big year for privacy with other state laws taking effect in Colorado, Connecticut, Virginia and Utah, said the same law firm’s Eden Marcu. Note that those are four very different states, said Gagnier, predicting four or five more could enact privacy laws next year. Two-thirds of states have considered comprehensive privacy bills, said Gagnier: States currently in session with privacy bills include Michigan, New York and Ohio. "It's something that you're going to see pop up state by state over the next couple years" until most states have comprehensive laws, she said. Don't bet on a federal law soon, said Gagnier, saying she doesn't expect Congress's American Data Privacy and Protection Act to go anywhere.