The California Consumer Privacy Act of 2018 (CCPA) went into effect January 1, 2020. While the CCPA was amended in October of 2019 to exempt certain employment and personal information involved in business-to-business (B2B) communications and transactions, those limited exemptions were set to expire on January 1, 2021. Although, the California Privacy Rights Act (CPRA or “CCPA 2.0”), which is on the November 3, 2020, state-wide general ballot, would extend the exemptions for employment and B2B data until January 1, 2023, businesses were uncertain whether the exemptions would lapse under the CCPA if the CPRA is not passed this November.

As a result, the California legislature voted to resolve this uncertainty and extend the B2B and employee exemptions under the CCPA until January 1, 2022, by passing Assembly Bill 1281. AB 1281 creates a backstop date for the B2B and employee exemptions and only takes effect if voters do not approve the CPRA. Therefore, AB 1281 and the CPRA create two alternative dates of when businesses will be legally required to fully incorporate employment and business-to-business data into their CCPA compliance programs:

• If the CPRA is not approved, the exemptions will expire on January 1, 2022.

• If the CPRA is approved then the exemptions will expire on January 1, 2023.

Troutman Pepper Tips

• While the language to the law was not amended (only the date which the exemption become inoperative), it is important for companies not to push out preparation simply because of the added timetable. As we have previously discussed, compliance with the law requires preparation and cannot be viewed as simply an exercise in updating a business’s privacy policy. Companies should continue to assess their data collection and processing practices through comprehensive data mapping—including in the employee and B2B context—and start assessing internal procedures and external facing policies and disclosures that will need to be addressed to meet the requirements come January 1, 2022.
• The bill’s past legislative history provided that the sunset period is intended to provide the legislature time to more broadly consider what privacy protections should apply to B2B and employment data. As such, regardless of whether the CPRA is approved by voters, businesses should expect lawmakers to continue legislating privacy protections surrounding B2B and employee information. Being prepared with complete data mapping and classification will allow businesses to be flexible and quickly adapt to continued CCPA refinement through legislative action.