California’s Governor Signs Extension of CCPA Exemptions for Employee and Business-to-Business Data

On September 29, 2020, California Governor Gavin Newsom signed AB 1281, which amends the California Consumer Privacy Act of 2018 (CCPA) with regard to its exemptions for employee-related personal data and for personal data in the context of a business-to-business relationship. These exemptions were set to expire on January 1, 2021, but AB 1281 extends them until January 1, 2022, and they might even be extended further, depending on California’s general election on November 3. The ballot for that election will include a provision to ratify the California Privacy Rights Act (CPRA), one of whose provisions would be to extend the above exemptions until January 1, 2023.

As noted in our prior alert, these exemptions are contained in Section 1798.145 of the CCPA, which exempts from most of that act's provisions personal information collected by a business in the course of an individual's acting as a job applicant, employee, owner, director, officer, medical staff member, or contractor of that business, to the extent that the personal information is collected and used by the business solely within the context of the individual’s relationship (or former relationship) to the business in such role. Additionally, Section 1798.145 exempts certain personal information in a business-to-business context, namely personal information “reflecting a written or verbal communication or a transaction between the business and the consumer,” if the consumer is an individual acting on behalf of a company and if the communication or transaction with the business occurs solely within the context of certain business activities.

The CPRA is slated for the ballot in California’s statewide general election on November 3, 2020. If approved, it will make significant amendments to the CCPA, including an extension of the above-described exemptions until January 1, 2023. If the CPRA fails, AB 1281 would remain in effect, extending the exemptions until January 1, 2022.

Businesses should keep an eye on the ever-changing privacy landscape in California and maintain compliance efforts accordingly. If you would like assistance with complying with the CCPA or reviewing your data privacy practices, please contact one of our cybersecurity & data privacy attorneys.