The question
What would the package cost California businesses, what would it save them in avoided cybercrime, and how would it move the state economy over the first ten years?
What BEAR found
The SRIA puts direct compliance costs at $3.5 billion in the first year and an average of $1.0 billion a year over the decade. Not every covered business faces every requirement: 25,167 would conduct cybersecurity audits, and between 13,082 and 52,326 would be subject to the risk-assessment and automated decisionmaking rules, depending on the scenario.
Quantified benefits from avoided cybercrime losses start at $1.5 billion in 2027 and reach $66.3 billion a year by 2036. In the model, the first-year cost shock lowers state output and employment; the trend reverses as savings accumulate. The revised October 2024 version adds decade totals of $9.7 billion in costs and $186 billion in quantified benefits.
Method
The BEAR dynamic CGE model of California (50 production sectors on 2022 IMPLAN data), run over 2027 to 2036 against the Department of Finance’s July 2024 conforming forecast. Direct costs were built up from the labor hours each compliance requirement takes.
Team
Drew Behnke, Jonathan Chang, Safa Faki, Samuel Neal and David Roland-Holst (BEAR), with Raul Tadle and Yan Zhou (California State University, Sacramento).
Public record
- SRIA as submitted to the Department of Finance (PDF)August 2024
- Revised SRIA, Initial Statement of Reasons Appendix A (PDF)California Privacy Protection Agency, October 2024
- Department of Finance comment letter (PDF)September 20, 2024
- Department of Finance major regulations tableRow dated 08/21/2024
- Agency rulemaking pagecppa.ca.gov
How to cite
Behnke, D., Chang, J., Faki, S., Neal, S., and Roland-Holst, D. (Berkeley Economic Advising and Research), with Tadle, R., and Zhou, Y. (California State University, Sacramento) (2024). Standardized Regulatory Impact Assessment: California Privacy Protection Agency. Prepared for the California Privacy Protection Agency.
