Cybersecurity Policy Report, Privacy Regulations Adopted, Advanced by CPPA; Director Resigns, (Nov 12, 2024)

By Tony Foley

At its monthly board meeting last week, the California Privacy Protection Agency (CPPA) adopted final regulations governing data broker registrations and advanced a proposed rulemaking package pertaining to insurance, cybersecurity audits, risk assessments, and automated decision making technologies (ADMT) as required by the California Consumer Privacy Act (CCPA). On the same day, Ashkan Soltani, the agency’s executive director, announced that he would leave the agency at the beginning of next year.

Data broker registration. In a Friday news release summarizing the board meeting, the CPPA said the data broker registration regulations would enact the provisions of California’s new Delete Act, which requires data brokers to register with the CPPA.

The final regulations, which will next be filed with the state Office of Administrative Review for review and approval and are scheduled to take effect on Jan. 1, 2025, define key terms, require data brokers to disclose specific information about their exempt data collection practices, and clarify procedures for registration changes. The CPPA board also moved separately to adjust the data broker registration fee for the January 2025 registration period to cover the cost of developing and maintaining the state’s data broker registry and the deletion mechanism required under the Delete Act.

Proposed rules for insurance, audits, risk management, and ADMT. The package of proposed rules approved by the board for movement to formal rulemaking include the following: (1) updates to existing CCPA regulations; (2) clarification of the circumstances under which insurance companies must comply with the CCPA; (3) implementation of requirements for certain businesses to conduct annual cybersecurity audits and risk assessments under specified circumstances; and (4) establishment of consumers’ right to access and opt out of a businesses’ use of ADMT.

The proposed rules are based on several years of rulemaking activity, including written comments and public stakeholder meetings, and will now move to the formal process where the public will have the opportunity to provide formal comments, the CPPA said. Once those comments are received, the board will provide additional opportunities to discuss and update the proposed rules, it said.

“The advancement of each of these regulation packages is crucial for protecting Californian’s privacy rights,” Mr. Soltani said. “Technology is evolving at a record pace, and we must innovate and evolve as well. The board’s vote today is an important next step in the Agency’s mission, and I applaud the care and thoughtfulness that went into developing the draft rules.”

Soltani resignation. The director’s comments came on the same day that it was announced, in a separate news release, that he would resign effective in January 2025. The release notes that Mr. Soltani was the CPPA’s first employee, starting in October 2021, and outlines a number of his significant contributions to the development of the agency and its work.

"It’s been an honor and privilege to serve as the founding Executive Director of the CPPA,” he said. “Californians enjoy the strongest privacy protections in the nation, thanks in part to the remarkable dedication and hard work of our talented team. I am confident the Agency is well-positioned to continue leading California—and the nation—in privacy and consumer protection, setting new standards, shaping policies that put people first, and building a future where individuals’ rights are protected and vigorously enforced."

CPPA Board Chair Jennifer Urban praised the executive director’s accomplishments. “I am grateful for Ashkan’s leadership and tireless work to make the Agency what it is today,” she said. “Thanks to his commitment and vision, the CPPA has a solid foundation and has numerous successes to build on for years to come.”

News: StateLegislation DataPrivacy CCPA