The State Privacy and Security Coalition Inc. must respectfully OPPOSE AB 1546 (Gabriel), as introduced February 17, 2023, which would significantly extend the statute of limitations that applies to civil enforcement actions brought by the Attorney General (AG) against businesses that violate the California Consumer Privacy Act (CCPA). Statutes of limitations play a critical role in our legal system by barring actions after a date certain. Currently, the CCPA requires the California Privacy Protection Agency to commence any administrative enforcement action no more than five years after the alleged violation occurred. This bill seeks to provide parity by also authorizing the AG to bring an action to enforce the CCPA within five years after the cause of action accrued. Simply put, parity is not a sufficient reason to drastically extend the applicable limitations period for the AG to commence civil CCPA enforcement actions. We are unaware of any examples of timebarred claims that the AG has been unable to pursue under existing law; to the contrary, we believe the AG has been able to vigorously enforce the CCPA. It is especially concerning to extend the limitation period here, when businesses have not been afforded the necessary tools (i.e., implementing regulations) and opportunity to successfully come into full compliance with this complex, and often vague, law. We urge you to reconsider the timing of, and need for, this proposal and strongly believe that there is potential to achieve greater consumer benefits by dedicating limited resources toward overseeing the prompt adoption of regulations and giving businesses adequate time to come into full compliance before pursuing actions against them.
In sum, because we are concerned that this change is (1) unwarranted and unfair, (2) contravenes established legal principles around the function of shorter limitations periods, (3) not in the interest of justice and due process rights of businesses (4) incentivizes the AG to wait until violations have accrued significantly before bringing a claim, and (5) exacerbates the compliance challenges that businesses face in an already unstable privacy law landscape, as they continue to await necessary regulations without the ability to at least seek guidance from the AG in the interim, we respectfully must OPPOSE AB 1546 (Gabriel).
