California Privacy Protection Agency Issues First-Ever Enforcement Advisory

On April 2, the California Privacy Protection Agency (CPPA or "the Agency") issued the Agency's first-ever enforcement advisory. The advisory ("Applying Data Minimization to Consumer Requests") reaffirms data minimization as a core principle of the California Consumer Privacy Act (CCPA) and stresses, in particular, that this principle applies to businesses' processing of CCPA data subject requests, such as the right to delete or right to opt-out.

To date, the California Attorney General (AG) has been the more active enforcer of the CCPA, bringing two enforcement actions and initiating a slew of investigative sweeps into areas such as streaming services, employee and job applicant information, and mobile applications. However, this enforcement advisory should serve as a warning for companies that the CPPA is ramping up its own CCPA enforcement efforts and will be paying particular attention to companies that engage in unnecessary or disproportionate collection or use