Even as enforcement of the California Consumer Privacy Act (the “CCPA”) begins, there is uncertainty as to whether and when employment information and business-to-business data will become fully subject to the CCPA. On Thursday, June 25, the California state Senate amended Assembly Bill 1281 (“AB 1281”) to extend until January 1, 2022 exemptions from the CCPA for certain employment information and personal information involved in business-to-business communications and transactions. See Cal. Civ. Code §§ 1798.100 to 1798.199. The bill would take effect only if it is enacted and the California Privacy Rights Act of 2020 (the “CPRA”) is not approved in the statewide general election on November 3.
Exemptions for Employment and Business-to-Business Information Under the CCPA
Currently, the CCPA provides two limited exemptions for employment-related information and information involved in business-to-business communications and transactions. Both of these exemptions become ineffective January 1, 2021. See Cal Civ. Code §§ 1798.145(h) and (n). First, subject to two exceptions, personal information of consumers within an employment relationship is exempt from the CCPA to the extent that the personal information is collected and used within the context of the employment relationship, having an emergency contact on file, or administering benefits. Notwithstanding this exemption, businesses must inform consumers at or before the point of collection that they are collecting these categories of information, and the personal information is subject to the CCPA’s private right of action for certain security incidents.
Second, the CCPA contains an exemption for a consumer’s personal information involved in business-to-business communications or transactions where the consumer is acting on behalf of a business and the communications or transactions solely relate to providing or receiving a product or service to or from another business. This exemption does not apply to the right to opt out of data sales or the anti-discrimination right, and the information is subject to the CCPA’s limited private right of action for security incidents.
Impact of AB 1281 on a Business’s Decision to Extend CCPA Compliance to Employment and Business-to-Business Data
There is uncertainty over when, if ever, employment and business-to-business data will become fully subject to the CCPA. Currently, the date is January 1, 2021. However, the date may change depending on whether AB 1281 is enacted and the CPRA is approved. The California Senate amended AB 1281 to create a backstop date of January 1, 2022 in case the CPRA is not approved in November. AB 1281 only takes effect if it is enacted and voters do not approve of a ballot measure that amends the employment and business-to-business data exemptions in the statewide general election on November 3. The CPRA is the only ballot measure that would, if approved, amend the CCPA’s exemptions. Therefore, AB 1281 and the CPRA create three potential dates of when, if ever, businesses will be legally required to fully incorporate employment and business-to-business data into their CCPA compliance programs:
- If AB 1281 is not passed and the CPRA is not approved, the exemptions will expire on January 1, 2021.
- If AB 1281 is passed and the CPRA is not approved, the exemptions will expire on January 1, 2022.
- Notwithstanding AB 1281, if the CPRA is approved then the exemptions will expire on January 1, 2023.
If AB 1281 is enacted, businesses will know that they have until at least January 1, 2022 to extend their CCPA compliance programs to employment and business-to-business data. Businesses should monitor whether AB 1281 is enacted before the legislative deadline at the end of September. If AB 1281 is not enacted, the CPRA will become even more important to businesses for determining whether to extend their CCPA compliance programs to employment and business-to-business data. We will continue to provide updates on AB 1281 if it progresses through the California state legislature.
