The California Consumer Privacy Act of 2018 (CCPA) went into effect January 1, 2020. While the CCPA was amended in October of 2019 to exempt certain employment and personal information involved in business-to-business (B2B) communications and transactions, those limited exemptions were set to expire on January 1, 2021. Although, the California Privacy Rights Act (CPRA or “CCPA 2.0”), which is on the November 3, 2020, state-wide general ballot, would extend the exemptions for employment and B2B data until January 1, 2023, businesses were uncertain whether the exemptions would lapse under the CCPA if the CPRA is not passed this November.
As a result, the California legislature voted to resolve this uncertainty and extend the B2B and employee exemptions under the CCPA until January 1, 2022, by passing Assembly Bill 1281. AB 1281 creates a backstop date for the B2B and employee exemptions and only takes effect if voters do not approve the CPRA. Therefore, AB 1281 and the CPRA create two alternative dates of when businesses will be legally required to fully incorporate employment and business-to-business data into their CCPA compliance programs:
- If the CPRA is not approved, the exemptions will expire on January 1, 2022.
- If the CPRA is approved then the exemptions will expire on January 1, 2023.
Troutman Pepper Tips
- The bill’s past legislative history provided that the sunset period is intended to provide the legislature time to more broadly consider what privacy protections should apply to B2B and employment data. As such, regardless of whether the CPRA is approved by voters, businesses should expect lawmakers to continue legislating privacy protections surrounding B2B and employee information. Being prepared with complete data mapping and classification will allow businesses to be flexible and quickly adapt to continued CCPA refinement through legislative action.