At present, the California Consumer Privacy Act (CCPA) has temporary and limited exemptions for the application of portions of the CCPA to personal information collected in the course of business-to-business (B2B) transactions and that of employees and job applicants. The exemptions are as follows:
- Personal information of consumers within an employment relationship is exempt from the CCPA to the extent that the personal information is collected and used within the context of the employment relationship, having an emergency contact on file, or administering benefits. Notwithstanding this exemption, businesses are still required to inform consumers at or before the point of collection that they are collecting these categories of information. In addition, the CCPA’s private right of action still applies if this information is subject to a security incident.
- A consumer’s personal information is exempted from the CCPA if the information is part of business-to-business communications or transactions where the consumer is acting on behalf of a business and the communications or transactions solely relate to providing or receiving a product or service to or from another business. This exemption does not impact consumers’ right to opt out of sales of their personal information, consumers’ right to non-discrimination, or the CCPA’s private right of action.
Both of these exemptions become ineffective January 1, 2021. However, on August 30, 2020, the California legislature passed AB1281, which would extend the exemptions to January 1, 2022, if approved. Governor Gavin Newsom has until September 30, 2020 to sign AB1281 into law.
This move was meant to act as a backup plan in the event that the California Privacy Rights Act of 2020 (CPRA) ballot initiative isn’t approved by voters in the November 3rd general election. If the CPRA is approved, these exemptions will automatically be extended to January 1, 2023. If the ballot initiative fails, AB1281 is meant to act as a backup plan that will extend the exemptions to 2022. In short, this leaves us with three possible outcomes:
- CPRA is approved: B2B and employment exemptions expire on January 1, 2023.
- CPRA is not approved, but AB1281 is passed: B2B and employment exemptions expire on January 1, 2022.
- CPRA is not approved and AB1281 is not passed: B2B and employment exemptions expire on January 1, 2021.
If you have questions about your business’s compliance with CCPA, please contact any of the attorneys in Varnum’s Data Privacy and Cybersecurity Team.