Page 103 - GDPR and US States General Privacy Laws Deskbook

11 C.C.R. § 7303. Stipulated Orders
(a)  At any time before or during an administrative hearing and in lieu of such a hearing, the Head of Enforcement and the
alleged violator may stipulate to the entry of a final order. If a stipulation has been agreed upon and the scheduled date
of the hearing is set to occur before the next Board meeting, the Enforcement Division will apply for a continuance of the
hearing.
(b) The final order must be approved by the Board, which may consider the matter in closed session.
(c) The stipulated final order shall be public and have the force of an order of the Board.
Note: Authority cited: Section 1798.185, Civil Code. Reference: Sections 1798.199.35 and 1798.199.55, Civil Code.
11 C.C.R. § 7304. Agency Audits
(a)  Scope. The Agency may audit a business, service provider, contractor, or person to ensure compliance with any provision
of the CCPA.
(b)  Criteria for Selection. The Agency may conduct an audit to investigate possible violations of the CCPA. Alternatively,
the Agency may conduct an audit if the subject’s collection or processing of personal information presents significant
risk to consumer privacy or security, or if the subject has a history of noncompliance with the CCPA or any other privacy
protection law.
(c) Audits may be announced or unannounced as determined by the Agency.
(d)  Failure to Cooperate. A subject’s failure to cooperate during the Agency’s audit may result in the Agency issuing a subpoena,
seeking a warrant, or otherwise exercising its powers to ensure compliance with the CCPA.
(e)  Protection of Personal Information. Consumer personal information disclosed to the Agency during an audit shall be
maintained in compliance with the Information Practices Act of 1977, Civil Code section 1798, et seq.
Note: Authority cited: Section 1798.185, Civil Code. Reference: Sections 1798.185, 1798.199.40 and 1798.199.65, Civil Code;
Section 11180, Government Code.
California Consumer Privacy Act of 2018 (as amended by the
103 | 
California Privacy Rights Act of 2020) and Related Regulations