As anticipated, on September 29, 2020, Governor Newsom signed into law Assembly Bill 1281 incorporating an extension of time for the sunset of the employee and business to business exemptions of the California Consumer Privacy Act of 2018 (“CCPA”) to January 1, 2022.
Both the B2B exemption and the employee exemption exclude certain categories of what would otherwise be personal information from falling within the scope of the CCPA.
Under the employee data carve-out, information processed about a natural person in their capacity as a job applicant, employee, owner, director, officer, medical staff member, or contractor of the business is exempt from most key provisions of the CCPA (with the exception of the Notice of Collection requirement and the right to bring a private right of action in the event of a data breach).
The B2B data carve-out exempts from most of the CCPA personal information reflecting a written or verbal communication or a transaction between the business and the consumer where the consumer is a natural person who is acting as an employee, owner, director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit, or government agency, and the communications or transaction with the business occur solely with the context of that business conducting due diligence regarding, or providing or receiving a product or service to or from that company, partnership, sole proprietorship, nonprofit, or government agency. The “Do Not Sell” opt out requirements still apply with respect to this category of data.
AB 1281, introduced by Assembly Member Ed Chau and signed into law by Governor Newsom, simply extends these existing employee and B2B exemptions, originally set to sunset on January 1, 2021, until January 1, 2022.
Although the California Privacy Rights Act (CPRA), Proposition 24, is on the California ballot for the November 3, 2020, election and would reinvent the wheel as to much of the CCPA’s requirements, it would not alter these exemptions in their existing form and would actually continue them to January 1, 2023 if the CPRA is voted into law. However, importantly, under the CPRA, come January 1, 2023, it would be next to impossible for the California legislature to amend the law to reinsert these exemptions, so they would likely disappear forever after that date.