Profiles in Government: A Closer Look at the California Privacy Protection Agency

The California Privacy Protection Agency (CPPA) has been getting a lot of public attention recently, as lawmakers and Gov. Gavin Newsom wrangle over legislation intended to regulate the use of artificial intelligence.

CPPA is in the spotlight as Newsom, legislators and industry advocates debate how far the Legislature should go in crafting limits on the technology. And CPPA, which was created four years ago, made headlines itself last month with the publication of its first annual report. It spelled out the agency’s mission, its influence and its achievements to date.

This week, Politico reported, Newsom wrote a letter urging the five-member CPPA board of directors “not to hurt the state’s flourishing AI sector as they weigh the potentially sweeping rules.” Tom Kemp, the executive director of the agency, told the outlet he appreciated Newsom’s interest and engagement.

Here's a closer look at the agency.

Leadership: CPPA's newly appointed executive director, Kemp, has been a policy adviser, cybersecurity expert, investor, entrepreneur and author before his appointment, which took effect April 1. As executive director, Kemp is CPPA's point person in its mission to enforce and implement California's privacy laws and ensure the public has a strong understanding of their rights. The agency notes: “In addition to having a strong background in policy, Kemp was also the co–founder and chief executive officer of Centrify (now Delinea), a leading cybersecurity cloud provider. He also authored Containing Big Tech: How to Protect Our Civil Rights, Economy, and Democracy. He holds a Bachelor of Science degree in computer science and history from the University of Michigan.”

CPPA’s chief information officer position is vacant.

The agency is governed by a five-member board of directors, led by Board Chair Jennifer Urban, a clinical professor of law at the University of California, Berkeley. The other directors are Alastair Mactaggart, Drew Liebert, Brandie Nonnecke and Jeffrey Worthe. Serving under Kemp are Tiffany Garcia, chief deputy director; Von Chitambira, deputy director of administration; Lisa Kim, senior privacy counsel and adviser; Phil Laird, general counsel; Michael S. Macko, deputy director of enforcement; Maureen Mahoney, deputy director of policy and legislation; and Megan White, deputy director of public and external affairs.

Budget and staff: Since its creation in 2020 with an initial budget of $5 million, its funding has grown to $12.8 million for the 2024-25 fiscal year. The agency has more than 40 employees working in the Executive Office and CPPA’s seven divisions: Administration, Audits, Enforcement, Information Technology, Legal, Policy and Legislation, and Public and External Affairs.

Newsom’s proposed budget, which will be refined next month during the May Revision, calls for 53 positions and a budget of $15.8 million, according to the state budget website.

By the numbers: According to its annual report, CPPA responds to digital privacy-related complaints from consumers, which break down like so:

• 84 percent involve complaints from consumers
• 57 percent involve the right to delete
• 48 percent involve the collection, use, storing or sharing of personal information
• 42 percent involve the right to opt out of sale or sharing of personal information

Looking ahead: The agency has published its strategic plan for Fiscal Year 2024-2027; it’s available here. Among other things, the report cites CPPA’s vision, mission and values and its four goals:

• Strengthen Public Education, Outreach and Engagement: This goal aims to provide resources, tools and support for delivering relevant, timely and accurate information to consumers and businesses.
• Vigorously Enforce Privacy Laws: This goal aims to protect consumers from violations of their privacy rights through engagement with the regulated community, timely investigations and enforcement actions.
• Strengthen California’s Privacy Rights: This goal aims to advance the privacy rights of all Californians by ensuring that statutes, regulations, policies and procedures support and further the mandates and mission of the agency.
• Operational Excellence: This goal aims to ensure an efficient and effective approach to organizational development, including the implementation of policies, programs and regulations.

Like many state agencies and departments, CPPA maintains a blog; it educates consumers and stakeholders and offers regular updates on a variety of topics. Posts cover CPPA news, updates on regulatory developments, privacy tips for consumers and insights into the evolving landscape of privacy protection. It also hosts the public-facing website privacy.ca.gov.