Small and minority business owners and operators have been sounding the alarm for months over the California Privacy Protection Agency’s (CPPA) process to adopt privacy regulations, which has systematically ignored how these rules will adversely impact our livelihoods. The result? An atmosphere of deep distrust and many unanswered questions.
The CPPA is racing headlong to finalize and enforce new regulations, seemingly determined not to let the concerns of small business owners like me stand in its way.
After missing a July 1, 2022, deadline to complete the rulemaking, the agency is now far behind schedule. At a recent hearing, agency board members did not even show up to hear public comments. Yet, it appears to be sticking to a January 1, 2023, compliance deadline with enforcement to take effect next July 1.
This leaves little room for incorporating any meaningful input from small businesses before the new rules are finalized and little time for small businesses to adjust their operations before the threat of punishment from the state.
Inviting, and then dismissing, public comment appears to be the agency’s preferred means of ignoring our material concerns. Why else would they engage in such condescension? The CPPA appears to equate small business engagement with posting notices online for public access.
As a long-time small and minority business advocate, I must ask: Is the California Privacy Protection Agency hoping to run out the clock and force new regulations upon the state’s more than 4 million small businesses without heeding our advice or making any substantive changes?
The relatively new agency was established by the California Privacy Rights and Enforcement Act of 2020 to adopt regulations to protect the privacy of consumers. There is no disagreement about the need for greater protections; small and minority-owned businesses understand the need and support the legislation. But we also understand that, while protecting individual privacy, regulations must, as the Act makes clear, give “attention to the impact on business and innovation.”
Black businesses throughout the state of California were hard hit by the pandemic. Many have closed their doors for good. Many were able to salvage their business by utilizing online tools and technology platforms to connect in different ways with existing customers and efficiently market their businesses to new ones. Now, just as Black businesses are seeing the positive results of these innovative strategies, they face the prospect of losing the businesses they’ve worked so hard to recapture during the pandemic.
To make matters worse, the Washington Legal Foundation estimates the average per-company cost of compliance will total close to $100,000. For many small businesses, that number is unattainable. Meanwhile, the privacy agency train continues to barrel down the tracks with little direction – no matter the cost.
In a sign of just how out of touch the agency is, the CPPA essentially assumes the only cost businesses will face is that of updating information on their websites. This assumption fails to consider lost sales and the expense of retooling sales and marketing efforts — all of which significantly drive up the cost of doing business.
The law firm Greenberg Traurig, commenting on behalf of the Foundation, concluded that “the CPPA did not complete a full or accurate economic analysis of the Proposed Regulations” as required by law, but instead submitted a “shorthand” statement that “grossly underestimates the full economic impact of the Proposed Regulations of California businesses.”
Greenberg Traurig concluded that this had the damaging effect of relegating the changes to the category of “non-major regulation,” which meant they would not receive a “proper review” by the state Department of Finance or Office of Administrative Law.
There’s still time for the CPPA to put the rulemaking process back on track. It can invite us into the process, take our views seriously and extend the enforcement deadline to alleviate small business concerns. With the well-being of California’s small businesses at stake, the agency cannot afford another misstep. q
Earl “Skip” Cooper II is Chairman of the Board and President Emeritus of the Black Business Association. He served on the Los Angeles Advisory Council of the Small Business Administration Region IX from 1978 to 1972.