The California Privacy Protection Agency (CalPrivacy) is entering an aggressive new phase of privacy regulation and enforcement, of which companies doing business in California should be aware. CalPrivacy already brought enforcement actions against many companies, maintains over 100 active investigations and has signaled an increased pace of enforcement.

A key development is the establishment of its new Audits Division, which will develop and apply privacy-compliance audit procedures and conduct complex regulatory examinations of businesses. Audits may focus on overall compliance or specific statutory requirements, particular industries or practices, or specific privacy harms such as the collection of children’s data.

CalPrivacy also proposed a whistleblower protection law, AB 2021, designed to incentivize insiders to report privacy violations. The bill would provide awards of between 15% and 33% of amounts collected by CalPrivacy, along with strong anti-retaliation protections.

Businesses subject to California privacy law should take note of these enforcement developments, take their data privacy obligations seriously and prepare accordingly. CalPrivacy emphasized that it is publishing bulletins and guidance to help businesses operationalize their compliance obligations, with quick guides and compliance checklists.