Earlier this month the California Privacy Protection Agency (CPPA) held its inaugural public meeting.  The CPPA was created under Proposition 24, the California Privacy Rights Act (CPRA), which was approved by California voters on November 3, 2020.

At the meeting, the Board covered a variety of administrative matters.  While there was limited discussion of substantive issues, the Board made several decisions relevant to the rulemaking process.

Among these decisions, the Board created three subcommittees focused on rulemaking and regulations, public awareness and guidance, and startup and administration.  The subcommittee on rulemaking and regulation includes Board members Lydia de la Torre and Jennifer Urban, and it has been charged with advising the full Board on priorities and planning for the upcoming rulemaking.  Once the subcommittee has decided on priorities for the upcoming rulemaking (e.g., algorithmic bias, high-risk processing, audit requirements), it will also be responsible for recommending the formation of additional subcommittees to focus on certain identified priorities.

Additionally, the Board discussed staffing of key positions for the agency, including an Executive Director and General Counsel.  The Board plans to consider candidates for the Executive Director position at the next meeting.  The Board plans to hire an Executive Director before assuming rulemaking authority.

The Board elected not to provide notice to the Attorney General that it is prepared to assume rulemaking authority.  The time when the CPRA rulemaking authority transfers from the Attorney General to the Agency depends on when the Board provides notice to the Attorney General that it is prepared to assume rulemaking authority.  At this point, rulemaking authority will transfer from the Attorney General to the Agency six months after the Agency provides such notice.

Going forward, the Board plans to meet on a monthly basis, but it has yet to set the date for future meetings.