Under the CCPA, what steps must the CPPA take before it can order a business to pay an administrative fine?
answer
- complaint, initiative or audit
- investigate, then probable cause
- 30 days' notice before that finding
- a hearing under the APA
- five years to commence
basics
~20 sUnder the CCPA, the CPPA investigates on a complaint or its own initiative, serves notice at least 30 days before deciding probable cause, then holds an Administrative Procedure Act hearing and orders any fine, unless the parties agree a stipulated order (1798.199.45-1798.199.55).
solid answer
~50 sA case starts with a **sworn complaint**, the agency's **own initiative**, or an **audit** (1798.199.45(a); 11 CCR 7300, 7301, 7304). The agency investigates and can **subpoena** records (1798.199.65). Before it may find **probable cause**, it must serve the business at least **30 days** ahead with a summary of the evidence and the right to attend with counsel (1798.199.50); the proceeding is private unless the business asks for it to be public, and the determination is final and not appealable (11 CCR 7302). If probable cause exists, it holds a **hearing under the Administrative Procedure Act**, and only if a violation is found does it issue an order to **cease and desist** and pay a **fine** (1798.199.55). The parties may settle by **stipulated order** (7303). The action must be commenced within **five years** of the violation (1798.199.70), and the decision is reviewable in court for **abuse of discretion** (1798.199.85).
go deeper
Recall the order of steps: a complaint, the agency's own initiative or an audit, then investigation, probable cause, hearing and order.
Explain what the 30-day probable-cause notice carries and why the proceeding is private unless the business asks otherwise.
Show what a team must be ready to produce at each step, and how the five-year window and tolling affect record retention for evidence.
Decide when to seek a stipulated order versus contesting at hearing, weighing publicity, precedent and remediation cost.
## Why the process matters to an engineer The CCPA as amended by the CPRA gave the **California Privacy Protection Agency (CPPA)** power to fine without going to court first. That power comes with a fixed sequence of steps, and each step asks the business for something: records during an investigation, a response before probable cause, evidence at the hearing. Knowing the sequence tells a team what it will be asked to produce and when. ## How a case starts - **Sworn complaint.** Anyone may file one; 11 CCR **7300** requires it to identify the alleged violator, state the facts with supporting evidence, authorise communication about it, give the complainant's contact details, and be signed under penalty of perjury. - **Own initiative.** The agency may investigate without a complaint (Civil Code 1798.199.45(a)); 11 CCR **7301(a)** adds referrals and nonsworn or anonymous complaints. - **Audit.** Under 11 CCR **7304** the agency may audit to investigate possible violations, or where processing presents **significant risk** to privacy or security, or the subject has a **history of noncompliance**. Audits may be **announced or unannounced**, and failure to cooperate can lead to a subpoena or warrant. The agency may decide not to investigate a complaint, or may offer a time to cure, weighing lack of intent and voluntary pre-notice efforts (1798.199.45(a)). ## Investigation The agency may **subpoena witnesses and records** and take evidence, including in exercising its power to audit (1798.199.65). The complainant is told in writing what action, if any, the agency took and why (1798.199.45(b); 11 CCR 7300(b)). ## Probable cause 1. **Notice.** No probable-cause finding without notice to the business at least **30 days** before the agency considers the alleged violation, by service of process or registered mail, with a **summary of the evidence** and notice of the right to be present with **counsel** (1798.199.50). 2. **Privacy of the proceeding.** It is **private** unless the business asks in writing for it to be public (1798.199.50); the regulations set that request at least **10 business days** before the proceeding (11 CCR 7302(c)(1)). 3. **Participants.** Only the alleged violator, its counsel and the agency's Enforcement Division take part; if the business does not appear, it waives further probable-cause proceedings (7302(c)(2)-(3)). 4. **Determination.** A written decision, **final and not subject to appeal** (7302(d)); probable cause means the evidence supports a reasonable belief the CCPA was violated (7302(a)). ## Hearing and order If probable cause exists, the agency **shall hold a hearing** under the **Administrative Procedure Act** (1798.199.55(a)). If it finds a violation, its order may require the business to **cease and desist** and to pay an **administrative fine** per violation; if it finds none, it publishes a declaration saying so. Persons jointly responsible are **jointly and severally liable** (1798.199.55(b)). At any time before or during the hearing the parties may agree a **stipulated final order**, which the Board must approve and which is **public** (11 CCR 7303). ## After the order, and the time limits | Step | Limit or standard | Source | |---|---|---| | Commencing an administrative action | within **five years** of the violation; commenced by serving the probable-cause notice; tolled during fraudulent concealment | 1798.199.70 | | Judicial review of a fine decision | **abuse of discretion** standard | 1798.199.85 | | Suing to collect an unpaid fine | within **four years** of the fine's imposition | 1798.199.75(b) | | Clerk's judgment after review ends | within **four years** of exhausting judicial review | 1798.199.80(e) | ## What a business should have ready Each step turns on records the business already keeps or should keep: - the consumer-request log and response records the regulations require, which show whether deadlines were met; - the published notices and privacy policy as they stood on the dates in question, with change history; - service-provider and third-party contracts for the data flows at issue; - evidence of when a problem was found and fixed, which feeds both the agency's decision whether to investigate and good-faith cooperation in setting any amount (1798.199.100). A team that can produce these quickly shapes the investigation; one that cannot invites subpoenas. ## Misconceptions - That the agency must sue in court to impose a fine; it goes to court only to collect. - That probable-cause proceedings are public by default. - That an audit needs a complaint first. - That a probable-cause determination can be appealed like a final order.
- Under the CCPA regulations, can the CPPA audit a business that no consumer has complained about?Yes. 11 CCR 7304(b) allows an audit to investigate possible violations, or where the subject's processing presents **significant risk** to consumer privacy or security, or it has a **history of noncompliance**. Audits may be announced or unannounced, and refusing to cooperate can lead to a subpoena or a warrant (7304(c)-(d)).
- Under the CCPA, when does the five-year limit for an administrative action stop running?Civil Code 1798.199.70 says the action is **commenced** when the probable-cause notice is served. The period is **tolled** while the business fraudulently conceals its acts or identity, and while it fails to produce documents a court ordered it to produce under subpoena.
saying these in an interview costs you the question
- The CPPA can impose a contested fine without a probable-cause finding or hearing.
- CPPA probable-cause proceedings are public by default.
- The CPPA can audit a business only after receiving a complaint.
- A probable-cause determination can be appealed like a final order.
- The CPPA must win a lawsuit before it can impose a fine.