Post-workshop DPIAs, July enforcement, clean rooms

**Jonathan:** Hey, Alysa. Good morning. **Alysa:** Hey. Happy post Fourth of July. **Jonathan:** Oh, yeah. Happy post Fourth of July. You know, gotta admit — when we started this privacy huddle, there was a part of me that thought, there's no way there's that much privacy news on a weekly basis. Like, there's just no way — it's gonna get too boring. And here we have the Chamber of Commerce and the California thing and Washington, which we'll talk about today. It's just wild. **Alysa:** No. There's so much drama. And then here's this breaking news — except that there's breaking news. It seems like pretty much almost on a daily or certainly weekly basis. **Jonathan:** For sure. For sure. It's crazy. So tell us about the California thing, because — so in my mind, one of the questions I really wanted to ask you there is: okay. So what is enforceable July first? What isn't? What's happening? Can you give us a lowdown? **Alysa:** Right. So July first was a huge date, I think, in every privacy practitioner's mind, because that was the date starting that California could enforce the new privacy regulations. And the CPRA regulations really fleshed out all the details that support CPRA — which is the statutory amendment to the CCPA, right? There are new definitions and new ways of how you need to address the rights that consumers have and how you need to operationalize those rights. And so there's this run up to that — to make sure that companies had those things implemented, ready to go, to manage their risk on enforcement. And you have the California Chamber of Commerce who had filed a lawsuit that I think many had thought was a long shot, saying, wait a second, CPPA — the agency who promulgated the regulations — you missed your deadline. You did not get these regulations out last July. You just got them done in March, and you want companies to comply with them by July first. That's not reasonable. That's not what the voters intended with the CPRA amendment. And so the court agreed. The court said yes, based on the plain language of the statute, these regulations are not enforceable. You need a year. So it's next March, twenty twenty-four. So you heard kind of this big sigh of relief by a lot of companies — and that puts that to the side, because you still have Colorado, Connecticut. Right? All of these others that certainly are enforced July first. You still have the CPRA statute, right, where the statute amends CCPA — that is still effective. And you have this question on — alright. So the statute amends. We have the California AG's regulation that amended CCPA 1.0. So are those kind of enforced? Meanwhile, most companies have been really working towards the CPRA and have operationalized the CPRA regulations. So I think at the end of the day, it becomes a very practical lens you have to look through and work towards. If you're not already there, you're continuing to work towards CPRA regulation compliance. We know the writing is on the wall, so to speak. You just have more time to fully hone and refine what you're doing. **Jonathan:** And how do we think about that, Alysa? Is the CPRA statute basically — opt-out of sale and share — you still got to do that? That's July first, fully enforceable. And then what do the regulations have in addition to the statute where we might have more time on? Or if there's too many to list, like, what's a — **Alysa:** Yeah. No. So I think one way of looking at it is every aspect of the CPRA statute has pretty lengthy regulations that ultimately elaborate on what it means to comply with, say, an opt-out of sale and share. Right? Here are these various scenarios, and here's how you would have to address them when somebody makes an opt-out request. And those are in the regulations. And so I think at the end of the day, you have to apply — at maybe a higher level, a more general level — reasonable opt-out. But if you've not yet figured out, for example, how to fully implement global privacy control in the way that the regulations 2.0 address, but maybe you've got it the way 1.0 addressed — you're gonna be — that is perfectly reasonable under the current status. But there's other things — I mean, we were talking about opt-outs — but I think there's a bigger part of this, at least from a burden standpoint, that is operationalizing the other privacy rights, where the regulations really go into detail in terms of what you need to do when you get a deletion request and how you need to address deletion. And so right now, that's not gonna be enforceable. And I think a lot of companies, that's where they needed a whole lot more time to address how to do that. **Jonathan:** Gotcha. Thank you. I don't want to oversimplify it, so tell me if this isn't a true statement. But is it something like: the regulations are still good guidelines — they're not enforceable — good place to look, but do the thing that's in the statute. You don't have to do it exactly maybe in the same way that the regulations do, but they're a good guide from now until March when they do become enforceable. **Alysa:** I think that that's right, but I also think there's not gonna be a whole lot of wiggle room come next year. Right? The expectation that you had plenty of time to get everything fully baked by then, and you still have the California Attorney General's office, which is going to enforce — has been enforcing. I think that they've got a whole lot of room to move within the CPRA statute itself. There's plenty of companies who are still working on basic opt-outs. So I think there's a decent amount of low-hanging fruit there. **Jonathan:** Awesome. Thanks, Alysa. We're gonna talk about the Washington AG's press release that came out yesterday. Tell us about that. **Alysa:** So we've talked in the past about the My Health My Data Act in Washington State, which is just a sea change on health privacy and what companies are obligated to do and how they need to protect health data. And there were lots of questions in terms of how and when are some of the provisions enforceable — right, are they effective starting this July, are they effective next March? There was just the presentation of those enforcement dates was not so clear. So that's one of the FAQs — on the Attorney General's office saying, no, no, no, here's which parts are effective as of July, but here are the other parts and they apply in x, y, z way. So I think that was a really helpful guiding point. If we see, for example, there's a private right of action — how these cases are gonna be enforced by the courts — courts are going to look at the Attorney General's guidance as a way to interpret. It's going to hold a decent amount of weight. There are other questions such as inferences. This is a time-old question. Are inferences about health status or health interests — is that covered? And the AG's guidance basically said, oh, yes, which wouldn't be all that different from what we had heard for California as to inferences there being within the scope. So I think that's a pretty clear marker for companies to think about. There are some other aspects covered in the regulations. There's this question — just given the breadth of the statute — if you are working with a service provider that is processing or storing the data in Washington State, does that suddenly bring everything within the context and jurisdiction of the My Health My Data Act? And the AG's office said, no. You ought to be a covered entity. Right? You're doing business, you're processing the information within Washington State — but just simply storing it without anything further, that wouldn't be enough. **Jonathan:** Gotcha. Awesome. Well, so much going on. **Alysa:** So much going on. We had two Republican nominees to the FTC, so that won't change the ultimate vote counts, but that'll be interesting to see that moving forward. **Jonathan:** And that was just last week. Let's see what happens over the next few days. Awesome. Thanks, Alysa. We appreciate it as always. Good to see you.