Privacy Regulations to Come in California, Along with Rulemaking for AI

By Mary T. Costigan, Jason C. Gavejian, Joseph J. Lazzarotti, Sean Paisan, Damon W. Silver & Robert Yang © Jackson Lewis December 22, 2022

​On Dec. 16, 2022, the California Privacy Protection Agency (CPPA) had its final meeting before the California Privacy Rights Act (CPRA) takes effect on Jan. 1, 2023. Despite the CPRA taking effect at the start of the year, the agency charged with implementing the law has not finalized its rulemaking process. The CPRA amended the California Consumer Privacy Act.

The final proposed rules are anticipated to be released at the end of January and will take effect in April after going through the various administrative requirements. In the meantime, regulations previously promulgated by the California Attorney General's Office will remain in effect.

Though it has not finalized its CPRA rulemaking, the agency is setting its sights on other rulemaking duties, including the use of artificial intelligence in data collection and businesses' cybersecurity assessments. The agency released sample questions covering these areas, which will be finalized and approved in the new year and then released for a comment period in order to collect insights on the framework needed for risk assessments and automated decision-making.

Some of the considerations pertaining to risk assessments that are detailed in the sample questions include laws and other requirements that businesses already have to comply with regarding processing consumers' personal information that require risk assessments and how those assessments can be aligned with the requirements under the CPRA.

Furthermore, the agency is considering whether assessments from other privacy statutes and regulations, such as the European General Data Protection Regulation and Colorado's Privacy Act, can be used for CPRA purposes.

Similarly, in considering rulemaking regarding automated decision-making, the agency is considering questions of other laws requiring access and/or opt-out rights in the context of automated decision-making. The sample questions also seek information about how prevalent algorithmic discrimination based on classification/classes under California and federal law is and if it is more pronounced in some sectors.

Mary Costigan, Jason Gavejian and Joseph Lazzarotti are attorneys with Jackson Lewis in Berkeley Heights, N.J. Sean Paisan is an attorney with Jackson Lewis in Irvine, Calif. Damon Silver is an attorney with Jackson Lewis in New York City. Robert Yang is an attorney with Jackson Lewis in San Francisco.



Hire the best HR talent or advance your own career.

Member Benefit: Ask-An-Advisor Service

SHRM's HR Knowledge Advisors offer guidance and resources to assist members with their HR inquiries.

SHRM's HR Knowledge Advisors offer guidance and resources to assist members with their HR inquiries.



HR Daily Newsletter

News, trends and analysis, as well as breaking news alerts, to help HR professionals do their jobs better each business day.