Mar 192021

An Agency Is Born: California Appoints Board of Its New California Privacy Protection Agency

Colleen Theresa Brown, Sheri Porath Rockwell and Sasha Hondagneu-Messner
, , , ,

On March 17, 2021, California officials announced the appointment of five board members of the California Privacy Protection Agency ( the “CPPA”), the first data protection agency in the United States.  The CPPA, created by the California Privacy Rights Act (“CPRA”) which California voters approved in November 2020, is charged with promulgating the CPRA regulations; enforcing the CCPA and CPRA; and educating consumers about their privacy rights.

Board appointees were drawn from academia, government, and public service:

  • Jennifer M. Urban (Chair), Director of University of California, Berkeley’s Law, Technology, and Public Policy Clinic.
  • John Christopher Thompson, a Senior Vice President of Government Relations for LA Olympics 2028 who also served for four years as Senator Dianne Feinstein’s Chief of Staff.
  • Angela Sierra, a career prosecutor for the California Department of Justice for 33 years, who most recently served as Chief Assistant Attorney General of the Public Rights Division.
  • Lydia de la Torre, a professor at Santa Clara University Law who also recently served as of-counsel to Squire Patton Boggs.
  • Vinhcent Le, a Technology Equity attorney at the Greenlining Institute, whose work focuses on consumer privacy, closing the digital divide, and preventing algorithmic bias.

In accordance with the CRPA, two Board members were appointed by Governor Newsom, while  California’s Attorney General, the California Senate Rules Committee, and the California Speaker of the Assembly each appointed one member.  The Board members serve at the pleasure of their appointing authority and have an eight-year term limit.

The Board’s first task will be to hire an executive director who will be charged with staffing the Agency, which will receive a minimum of $10 million in annual funding.  Agency staff will need to be ready to act quickly, with CPRA rulemaking scheduled to begin this summer.  As the Agency gets up and running, staff at the Attorney General’s office will be providing support.

Colleen Theresa Brown

Washington, D.C.

cbrown@sidley.com

Sheri Porath Rockwell

Century City

sheri.rockwell@sidley.com

Sasha Hondagneu-Messner

New York

shondagneumessner@sidley.com

You might also like
UK’s New Pro-innovation Approach to Regulating Digital Technologies

On 15 March 2023, the UK Government published, alongside its Spring Budget, a report on the Pro-innovation Regulation of Technologies Review (the “Report”). The Report was led by the government’s Chief Scientific Advisor and National Technology Officer, Sir Patrick Vallance, who was tasked with “bringing together the best minds to advise how the UK can better regulate emerging technologies, enabling their rapid and safe introduction.” In response, the UK Government has accepted all of the Report’s recommendations, and set out some next steps for their implementation.

FCC Proposes Updated Data Breach Reporting Requirements, Comment Period Ongoing

On January 6, 2023, the Federal Communications Commission (the Commission) released a unanimously adopted Notice of Proposed Rulemaking, “In the Matter of Data Breach Reporting Requirements” (Proposed Rule).  The Commission sought comments through February 22, 2023 on the Proposed Rule which will update its current data breach reporting rule. Reply comments are due on or before March 24, 2023.

U.S. Employers Need to Reconsider Use of Confidentiality and Nondisparagement Provisions in Light of New NLRB Decision

Employers frequently seek to include confidentiality and nondisparagement provisions in severance agreements provided to departing employees. Last week, the U.S. National Labor Relations Board (NLRB or Board) significantly altered the legal landscape governing such provisions, making it much more difficult for unionized and nonunionized employers alike to use them for nonsupervisory employees without running afoul of the National Labor Relations Act (NLRA). The decision is likely to be appealed, and we will issue updates as they become appropriate. In the interim, however, it is critically important for employers to understand the implications of the decision (see below) and to adjust their use of these provisions to limit their risk.