California Is Moving Closer to Extending the CCPA Exemptions for Employee and Business-to-Business Data

By the virtue of amendments enacted in October of 2019, the California Consumer Privacy Act (CCPA) currently exempts employee and business-to-business information from most of the Act’s requirements.  However, these exemptions are scheduled to expire at the end of 2020.  Recently introduced amendments to the CCPA, however, would extend these exemptions for at least another year.

Under the so-called “employee exemption,” the CCPA exempts from all provisions of the Act, except the private right of action and notice at collection, information collected from a person by a business in the course of the person acting as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or contractor of that business.  The exemption applies only to the extent that the information is collected and used by the business solely within the context of the person’s role (or former role) as a job applicant to, an employee of, an owner of, director of, officer of, medical staff member of, or contractor of that business.

By the same token, the “business-to-business exemption,” provides that with the exception of the right to opt-out, non-discrimination, and the private right of action, the CCPA does not apply to personal information reflecting business-to-business communications and transactions within the context of business conducting due diligence or where a product or service is provided or received.

The General Assembly’s decision last October to sunset these exemptions at the end of 2020 effectively kicked the can on the final decision on the merits of these provisions down the road.   This, in turn, created a great deal of uncertainty for businesses subject to the CCPA.  Should they develop their compliance framework with an expectation that employee and business-to-business data will soon be within the scope of the Act or should they wait and see until the law is settled by the legislature?

There is now a little bit more clarity, albeit not a lot of certainty, on these issues.  First, the California Privacy Rights Act (CPRA), which recently qualified for the November ballot, would extend both exemptions for another two years until January 1, 2023.  Second, the California legislature recently amended an already pending bill, AB-1281, specifically to extend the exemptions until January 1, 2022 in the event that the CPRA is not approved by the voters.

Thus, it is increasingly likely that the employee and business-to-business exemptions will extend for at least another year.  If the CPRA passes, further extensions will be extremely unlikely, if not impossible, and businesses will have two years to bring the exempt data within the compliance framework. If the CPRA fails which, given that over 80% of Californians support the ballot measure, is very unlikely, the status quo uncertainty will continue until the legislature makes a final decision on the exemptions.

Ask Clarip today how we can solve your biggest privacy compliance pain points, Call Clarip at 1-888-252-5653