Does the California Privacy Protection Agency have to follow the law?

The California Privacy Protection Agency’s (“Agency”) long-waited regulations to guide enforcement of the California Consumer Privacy Act (“CPRA”) were approved by the California Office of Administrative Law on March 31, 2023. These regulations were mandated by the CPRA to provide clarity for businesses required to comply with the CPRA. The regulations are late – very late. According to the CPRA, businesses were to be give 12 months from the final regulations before enforcement was to begin. Instead, the Agency gave businesses three months. The California Chamber of Commerce has the same question and filed a lawsuit on March 30th in Sacramento Superior Court on behalf of its members asking the court to order the California Privacy Protection Agency (“CPPA”) to promptly adopt comprehensive, complete, and final regulations implementing Proposition 24 and prohibit any civil or administrative enforcement of Proposition 24 by the Attorney General’s office or the CPPA until businesses receive the implementation time that the voters approved, which is 12 months after regulations are adopted.