When Do Prop. 24’s Privacy Protections Take Effect?

Questions have arisen in recent days about when Proposition 24 takes effect. Prop. 24 adopted the California Privacy Rights Act of 2020 (CPRA). Section 31 of the Prop. 24 that was adopted by the statewide electorate at the November 3 election addresses the ballot measure’s effective and operative dates. Before getting to the language of Section 31, it is important to understand the distinction between effective and operative dates.

A common definition of “effective date” is when the new law is “on the books.” A common definition of “operative date” is when the new law becomes operative (which commonly, but mistakenly, is described as when the new law is “in effect”). Specifically, an operative date is distinguished from an effective date. “A statute may be worded so as to provide for an operative date other than its effective date” 28 Ops. Atty. Gen. 20 (1956). An operative date, therefore, may be the same as the effective date, or it may be different than the effective date.

In turning to Section 31 of Prop. 24, it is titled “effective and operatives dates.” In the first sentence of subdivision (a), Prop. 24 specifies that the CPRA becomes effective (i.e., it is “on the books”) as set forth in Article II, Section 10 of the California Constitution, which is the general provision of law for the effective date of an initiative or referendum.

What does Section 10 of Article II of the state Constitution provide? “(a) An initiative statute or referendum approved by a majority of votes cast thereon takes effect on the fifth day after the Secretary of State files the statement of the vote for the election at which the measure is voted on, but the measure may provide that it becomes operative after its effective date.”

According to the California Secretary of State, “The Statement of Vote reports the county-by-county votes cast for each candidate and measure on the ballot. In a statewide contest such as Governor, the vote is reported by all 58 counties and listed in alphabetical order with the statewide total at the bottom.” The Secretary of State is expected to issue the Statement of Vote on December 12. Assuming that date, then Prop. 24 takes effect on December 17.

In the second sentence of subdivision (a), Prop. 24 provides that, with specified exceptions, the CPRA becomes operative on January 1, 2023. Furthermore, it states that, “with the exception of the right of access,” the CPRA only applies to personal information collected by a business on or after January 1, 2022. As a result, almost all of the provisions, with the exceptions set forth below, of Prop. 24 are operative just over two years from now. Nonetheless, its provisions apply to business-collected personal information in just over a year from now.

In subdivision (b), Prop. 24 provides that Section 1798.145(m), Section 1798.145(n), Section 1798.160, Section 1798.185, Sections 1798.199.10 through 1798.199.40, inclusive, and Section 1798.199.95 are operative on the effective date of the act, which we understand will be December 17. What are these exceptions that have an operative date next month?

Section 1798.145(m) – This subdivision states that the CPRA does not apply to specific items, such as personal information collected by a business from job applicants, or emergency contact information, or that is need by the business to administer benefits.

Section 1798.145(n) – This subdivision specifies that certain obligations imposed on businesses by numerous sections of the CPRA do not apply to personal information reflecting a written or verbal communication or a transaction between the business and the consumer in certain circumstances.

Section 1798.160 – This section creates the Consumer Privacy Fund that is created within the General Fund and is to cover state court costs, Attorney General costs, and grants made to promote and protect consumer privacy.

Section 1798.185 – This section deals with regulations adopted to interpret and administer the CPRA and the California Consumer Privacy Act of 2018 (CCPA).

Sections 1798.199.10 – This section establishes in state government the California Privacy Protection Agency.

Section 1798.199.15 – This section deals with members of the Privacy Protection Agency board.

Section 1798.199.20 – This section provides that members of the agency board, including the chairperson, serve at the pleasure of their appointing authority, but shall serve for no longer than eight consecutive years.

Section 1798.199.25 – This section specifies that for each day on which they engage in official duties, members of the agency board are compensated $100, plus expenses incurred.

Section 1798.199.30 – This section provides that the agency board appoints an executive director who acts in accordance with agency policies and regulations and with applicable law.

Section 1798.199.35 – This section states that the agency board may delegate authority to the chairperson or the executive director to act in the name of the agency between meetings of the agency with specified exceptions.

Section 1798.199.40 – This section specifies that the agency performs specified functions.

Section 1798.199.95 – This section appropriates $5 million from the General Fund to fund the Privacy Protection Agency that is created by Prop. 24.

In subdivision (c), Prop. 24 specifies that the provisions of the California Consumer Privacy Act of 2018, as amended by Prop. 24, remain in effect and are enforceable until the same provisions of the CPRA become operative and enforceable, which is January 1, 2023.