California Privacy Protection Agency begins an important rulemaking in an accelerated process that is likely to impose AI regulations


AI Outlook

AI Outlook

Data Protection, Privacy and Security Alert


Special regulation of AI in the US has been very limited thus far.   That will likely change as part of a broader California privacy rulemaking that will occur next year.  This rulemaking is likely to result in California regulating by 2023 some range of automated decision-making using personal data of California residents. 

The new California Privacy Protection Agency has asked for and will receive initial pre-rulemaking comments on November 8 on this and several other important privacy and data security issues.  As to AI, the agency, created by the California Privacy Rights Act Initiative approved by the voters in November 2020, is charged under this Initiative with:

(16) Issuing regulations governing access and opt-out rights with respect to businesses’ use of automated decisionmaking technology, including profiling and requiring businesses’ response to access requests to include meaningful information about the logic involved in those decisionmaking processes, as well as a description of the likely outcome of the process with respect to the consumer. 

Cal. Civ. Code § 1798.185(a)(16). 

Thus, three potential rights are at issue: 

(1) a right of access about meaningful information concerning the logic involved in covered automated decision-making processes – tempered by another required rulemaking on protecting trade secret information from consumer requests, id. § 1798.145(a)(3)

(2) a right to a description of the likely outcome of a process as it affects the consumer and

(3) some sort of opt out right with regard to automated decision-making processes.

In contrast to the specific privacy rights set forth elsewhere in the CPRA, this text on the AI rulemaking (as well as text regarding several other new issues for rulemaking) is general and open-ended.  It does not reference the scope of, procedures for, or exceptions to these rights, although the CPPA agency can fill in these blanks. 

Furthermore, the CPPA Agency Board includes Vinhcent Le, a prominent advocate on AI equity issues working at the Greenlining Institute. Mr. Le and four other board members are charged with overseeing the rulemaking and have final authority to approve the rules. 

All these factors make it important for businesses that process or envision processing personal data of California residents in AI processes to follow this rulemaking closely and consider filing comments. 

The pre-rulemaking invitation to comment issued by the CPPA asks five questions regarding interpretation of the CPPA agency’s automated decision-making rulemaking authority:

  1. What activities should be deemed to constitute “automated decisionmaking technology” and/or “profiling” (a critical scoping issue)
  2. When consumers should be able to access information about businesses’ use of automated decisionmaking technology and what processes consumers and businesses should follow to facilitate access
  3. What information businesses must provide to consumers in response to access requests, including what businesses must do in order to provide “meaningful information about the logic” involved in the automated decisionmaking process
  4. The scope of consumers’ opt-out rights with regard to automated decisionmaking, and what processes consumers and businesses should follow to facilitate opt outs (another critical scoping question).

CPPA Board Chair Jennifer Urban indicated at a California Bar webinar that the board will review the pre-comments which are filed by November 8 with the goal of issuing proposed rules for comment in January or February 2022, and that it hopes to issue final rules some time in May 2022, with the rules taking effect in 2023

Even if this date slips a few months, this is a tight timeframe for a new agency, which must address not only this but a long list of other issues.  The timeframe also would not allow more than one, or possibly two, further opportunities to comment before the rules are finalized. 

Businesses that engage in or plan to engage in or invest in potentially affected AI processing may want to consider commenting.  Even if they do not comment, they may want to follow this important proceeding carefully. 

To learn more about this development, please contact the author or your usual DLA Piper attorney.