Calif. Privacy Agency Asks Court Not to Set 'Date Certain' for Upcoming Rules

A state court needn’t set a deadline for the California Privacy Protection Agency (CPPA) to make rules on cybersecurity audits, risk assessments and automated decision-making technology, with enforcement “still distant,” the agency said Wednesday. The California Superior Court of Sacramento asked May 3 if it should set a “date certain” for those rules after the California Chamber of Commerce’s lawsuit against the agency returned to the court. The court scheduled a June 21 hearing on the question. In February, California’s 3rd District Court of Appeal reversed the court’s June decision that granted a CalChamber petition and stayed any CPPA rules for 12 months after they become final. CalChamber petitioned for review at the California Supreme Court (see 2402210031), but that court declined to take the case on April 24. As a result, the only remaining issue for the Superior Court to decide is whether to set a deadline for the upcoming CPPA rules. In its Wednesday brief, the privacy agency said it started drafting remaining rules at issue in the case and will finalize them "once it has determined that it has received sufficient feedback from stakeholders and obtained necessary approval from state control agencies. In the meantime, it will not enforce the law in the specific areas still subject to regulation. Petitioner is entitled to nothing more.” It would be “improper” for the court to set a deadline because the Administrative Procedure Act (APA) “rulemaking process involves a substantial exercise of judgment and discretion over the timeline of the process itself,” the agency said in case 34-2023-80004106-CU-WM-GDS. “Petitioner's interests are already protected by enforcement delays and the APA-mandated procedures for stakeholder input.” The agency already took more feedback than the APA requires in a pre-rulemaking phase and will soon seek more input when it opens a formal rulemaking process, added the agency. In another brief, CalChamber pointed out that the agency was supposed to adopt final rules by July 1, 2022. “Petitioner continues to be concerned about the Agency’s timeline for fulfilling its statutory obligations with respect to the three outstanding rulemakings.” Given the coming rules’ significance, CalChamber "remains invested in ensuring the Agency does not attempt to adopt the regulations on a timeline that does not allow sufficient time for stakeholder review and participation, public comments, and meaningful consideration of public input,” said the business group. That said, CalChamber noted that only the agency "can fully address the anticipated timing for the adoption of the outstanding regulations.”