By Allison Grande

Law360 (March 24, 2020, 10:57 PM EDT) -- Advocacy group Consumer Reports is pushing back at industry calls for the California attorney general to delay enforcement of the state's landmark consumer privacy law in light of the coronavirus pandemic, arguing such a move would deprive consumers of vital data privacy protections at a time when they're sorely needed.

Dozens of businesses and groups signed onto a letter last week urging Attorney General Xavier Becerra to postpone the scheduled July 1 start of enforcement of the California Consumer Privacy Act until Jan. 2, 2021. The coalition — which included the California Chamber of Commerce, UPS and the Association of National Advertisers — cited compliance challenges raised by the rapid spread of the novel coronavirus and the unfinished nature of the regulations that the attorney general is writing to guide companies in implementing the first-of-its-kind law.

An adviser to the attorney general responded to the letter by confirming that the office was "committed to enforcing the law upon finalizing the rules or July 1, whichever comes first," while stressing that it was "mindful of the new reality created by COVID-19 and the heightened value of protecting consumers' privacy online that comes with it."

In a statement Monday, Consumer Reports encouraged the attorney general to continue to stay the course, echoing the regulator's sentiments about the need to ensure robust online privacy protections in these unprecedented times.

"Now that more consumers are working from home and relying on tech companies for crucial communications, the Attorney General needs to ensure that appropriate safeguards are in place," said Maureen Mahoney, a policy analyst at Consumer Reports. "Consumers shouldn't have to give up their constitutional rights to engage in essential activities."

The CCPA, which became law in June 2018, is the first law in the nation to give consumers the right to learn what data companies hold about them, request that the data be deleted and opt out of the sale of that information. While the law took effect Jan. 1, the attorney general isn't allowed to start bringing enforcement actions until July 1.

Consumer Reports' Director of Privacy and Technology Policy Justin Brookman pointed to the long lead time that companies have had to get up to speed with the CCPA in advance of the enforcement deadline in slamming the business community's "cynical attempt ... to avoid honoring California consumers' constitutional right to privacy."

"Industry shouldn't exploit the health crisis to ignore consumer requests to companies to stop selling their data," Brookman said, stressing that the law has been in effect for nearly three months.

"It is more critical than ever for policymakers to ensure fairness, safety and transparency for consumers in the marketplace," Brookman added. "We hope the attorney general does the right thing and begins enforcement as scheduled."

Consumer Reports noted in the statement that it was going to include its position in comments it plans to submit to the attorney general ahead of a Friday deadline to offer feedback on the latest version of the draft regulations.

Since the CCPA was rushed into law in June 2018, business groups and consumer advocates have sparred over what types of personal information and data-handling practices should be covered by the law. The business community has pressed for changes such as permanently exempting employee data and explicitly allowing data to be used for targeted advertising and loyalty programs, requests that state lawmakers rejected last year.

Companies across a range of industries have also pushed the California attorney general to rein in his proposed implementing regulations, which they argue exceed the scope of what's required by the law, and five top advertising trade groups wrote to Becerra in January seeking a delay in enforcement to give businesses more time to comply with their still-evolving obligations.

In a Tuesday interview with Law360, Mahoney of Consumer Reports said that tech companies have been attempting to avoid regulation for years, and that sticking with the planned enforcement deadline was vital to incentivize companies to comply with the new obligations.

"If these rules are voluntary, then companies are just going to flout them," she said, adding that many companies have been evading compliance with CCPA already by taking steps such as "claiming exceptions that don't exist to avoid putting up do-not-sell buttons."

Consumer Reports said the attorney general's office has already made it clear that it only has the resources and capability to bring a few enforcement actions per year and that it's planning to focus on prosecuting "only flagrant violations" of the CCPA.

Therefore, "companies making a good-faith effort to comply shouldn't have anything to worry about," Mahoney added.

--Editing by Breda Lund.

For a reprint of this article, please contact reprints@law360.com.