CCPA’s Employee and Business-to-Business Information Exemptions Extended Until At Least January 1, 2022

Troutman Pepper
Contact

Troutman Pepper

The California Consumer Privacy Act of 2018 (CCPA) went into effect January 1, 2020. While the CCPA was amended in October of 2019 to exempt certain employment and personal information involved in business-to-business (B2B) communications and transactions, those limited exemptions were set to expire on January 1, 2021. Although, the California Privacy Rights Act (CPRA or “CCPA 2.0”), which is on the November 3, 2020, state-wide general ballot, would extend the exemptions for employment and B2B data until January 1, 2023, businesses were uncertain whether the exemptions would lapse under the CCPA if the CPRA is not passed this November.

As a result, the California legislature voted to resolve this uncertainty and extend the B2B and employee exemptions under the CCPA until January 1, 2022, by passing Assembly Bill 1281. AB 1281 creates a backstop date for the B2B and employee exemptions and only takes effect if voters do not approve the CPRA. Therefore, AB 1281 and the CPRA create two alternative dates of when businesses will be legally required to fully incorporate employment and business-to-business data into their CCPA compliance programs:

  • If the CPRA is not approved, the exemptions will expire on January 1, 2022.
  • If the CPRA is approved then the exemptions will expire on January 1, 2023.

Troutman Pepper Tips

  • While the language to the law was not amended (only the date which the exemption become inoperative), it is important for companies not to push out preparation simply because of the added timetable. As we have previously discussed, compliance with the law requires preparation and cannot be viewed as simply an exercise in updating a business’s privacy policy. Companies should continue to assess their data collection and processing practices through comprehensive data mapping—including in the employee and B2B context—and start assessing internal procedures and external facing policies and disclosures that will need to be addressed to meet the requirements come January 1, 2022.
  • The bill’s past legislative history provided that the sunset period is intended to provide the legislature time to more broadly consider what privacy protections should apply to B2B and employment data. As such, regardless of whether the CPRA is approved by voters, businesses should expect lawmakers to continue legislating privacy protections surrounding B2B and employee information. Being prepared with complete data mapping and classification will allow businesses to be flexible and quickly adapt to continued CCPA refinement through legislative action.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Troutman Pepper | Attorney Advertising

Written by:

Troutman Pepper
Contact
more
less

Troutman Pepper on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.