As the California legislature session concluded at the end of August, a significant amendment to the CCPA finally passed both houses. California bill AB-1281 passed the Senate in the last days of the month, extending the business-to-business and employee/applicant carve-outs through January 1, 2022 (as we wrote about previously). The bill now sits with Governor Newsom to sign before the end of September.
The passage of this bill likely brings some welcomed relief to companies subject to CCPA, as the existing exemptions were set to expire at the end of 2020. While the requirements under CCPA will not fully apply to B2B communications and employee/applicant information, a reminder that in its current form, CCPA still imposes certain obligations for this type of information. Namely, that businesses must provide a notice at collection for employee/applicant information. And, all personal information, regardless of from whom it is collected, is subject to the data breach provisions.
Once signed by the Governor, AB-1281 is set to go into effect only to the extent the California Privacy Rights Act (CPRA or Prop 24) fails the November ballot. However, if CPRA is enacted, then the exemptions will be extended until January 1, 2023.
Putting it Into Practice: Organizations can let out a sigh of relief knowing that will in all likelihood not need to expand their CCPA compliance programs by January 1, 2021 to address the expiration of the business-to-business and employee/applicant carve-outs. Want a current version of the law? For easy reference to keep track of the most current version of the CCPA statute (i.e., without this proposed amendment) we have compiled both the CCPA statute and the regulation (as well as GDPR) here. We will update this link should AB-1281 be signed into law.