Alerts

Privacy Update for Private Fund Managers: California AG Issues Final CCPA Regulations, Intends to Begin Enforcement July 1

June 12, 2020

Final Regulations May Be Effective as Early as July 1

One month before the July 1, 2020 enforcement date of the California Consumer Privacy Act (“CCPA”), the California Attorney General submitted the final text of proposed regulations under the CCPA to the California Office of Administrative Law (“OAL”) for review.[1] While OAL has 30 working days, plus an additional 60 calendar days,[2] to review the final regulations for compliance with California administrative law, the Attorney General has requested expedited review that would permit the final regulations to become effective on July 1, 2020.[3] As it is possible that, notwithstanding a significant backlog,[4] OAL could review the final regulations in this timeframe, now is the time for fund managers who are subject to the CCPA[5] to review their privacy policies and practices for compliance with the final regulations.

Our March 10, 2020 Alert and our March 24, 2020 Alert[6] discuss key considerations for private fund managers raised by the drafts of the CCPA regulations issued by the California Attorney General in February and March. As the final regulations are substantively the same as the draft regulations issued in March, the considerations outlined in these Alerts remain pertinent to a review of your privacy policies and practices in advance of July 1. For many fund managers, compliance with the final regulations will only involve making minor updates to their CCPA privacy notices.

CCPA Enforcement Commences July 1

Despite pressure to push back the CCPA enforcement date to January 2021 in light of the COVID-19 pandemic, the attorney general has stated that, consistent with the provisions of the statute, his office will commence enforcement of the CCPA on July 1, 2020.[7] As discussed in our previous Alert, actions brought after July 1 may relate back to conduct on or after the statute’s Jan. 1, 2020 effective date. It is important to note that the July 1 enforcement date will apply whether or not the regulations are finalized by July 1. If the OAL does not approve the final regulations by July 1, it is only the effective date of the regulations that will be delayed.

What Fund Managers Should Do Now

As July 1 approaches, fund managers who are subject to the CCPA will want to confirm that their current privacy policies and practices comply with the CCPA, including the final regulations. Here are a few key action items:

Confirm that, in addition to posting a privacy policy on your website, you have taken steps to make the appropriate disclosure to California residents at the “point of collection” for personal information (e.g., by including a CCPA notice in marketing materials or emails sent to prospective investors);[8]
Add to your privacy policy an explanation of how you will process and verify requests made by California residents under the CCPA, such as requests about the types of personal information you have collected about them or to delete their personal information (to the extent retention requirements do not apply);[9]
Make sure your privacy policy is able to be printed and can be obtained as a .pdf or in another format accessible to persons with disabilities; and
Consider if any measures need to be taken to meet the CCPA’s training requirements, as discussed in our Feb. 18, 2020 Alert.

Authored by Brian T. Daly, Marc E. Elovitz, Edward H. Sadtler, Kelly Koscuiszka and Jennifer A. Gordon.

If you have any questions concerning this Alert, please contact your attorney at Schulte Roth & Zabel or one of the authors.

[1] The Attorney General’s website, available here, provides the complete package submitted to OAL, which includes the full text of the final regulations and the attorney general’s final statement of reasons. The attorney general’s final statement of reasons provides useful explanations for some of the changes made to the regulations throughout the various drafts.

[2] The additional 60 calendar days is under Executive Order N-40-20, available here, related to the COVID-19 pandemic.

[3] Under California law, if the regulations are not approved by July 1, they likely will not go into effect until Oct. 1, 2020. The substantive requirements of the regulations would be the same.

[4] According to OAL’s website, available here, as of June 11, 2020, the CCPA regulations are one among a total of 66 proposed regulations before OAL for review.

[5] Our Dec. 6, 2019 Alert provides further information on how the CCPA applies to fund managers.

[6] Our March 10, 2020 Alert and March 24, 2020 Alert discuss the draft CCPA regulations issued by the attorney general in February and March, respectively.

[7] In a press release on June 2, 2020, the attorney general emphasized that the enforcement will begin on July 1, stating, “businesses have had since January 1 to comply with the law, and we are committed to enforcing it starting July 1.”

[8] See our Dec. 6, 2019 Alert for a more detailed discussion.

[9] Other updates you may need to make to your privacy policy based on the regulations are discussed in our March 10, 2020 Alert and our March 24, 2020 Alert.

This communication is issued by Schulte Roth & Zabel LLP for informational purposes only and does not constitute legal advice or establish an attorney-client relationship. In some jurisdictions, this publication may be considered attorney advertising. ©2020 Schulte Roth & Zabel LLP.