B2B and HR Data: The CCPA's Biggest Exemptions May Get a Last Minute Extension
Co-Authored By: Stacey Shadden and Micah Carlson (Graduate Clerk)
Since the California Consumer Privacy Act (CCPA) entered into force on July 1, 2020, the Human Resources (HR) and Business-to-Business (B2B) exemptions have served as critical exemptions from the scope of the law. When the California Privacy Rights Act (CPRA) was adopted, these two exemptions were set to expire on January 1, 2023, the same day that the CPRA is set to go into effect. However, California lawmakers may attempt to push back the sunset date for these two exemptions before the end of California’s legislative session. Here’s what you should know:
What are the HR and B2B exemptions?
The HR exemption provides employers with a limited reprieve from the general requirements of the CCPA when processing the personal information of their employees, contractors, job applicants, and other similar personnel. Additionally, the HR exemption has permitted employers to provide less extensive disclosures to such personnel when providing a privacy notice. Similarly, the B2B exemption has operated as a carveout from the general applicability of the CCPA. Under the B2B exemption, communications that would normally fall under the scope of the CCPA are nonetheless exempted when such communications are made between a covered business and a consumer who is acting as an employee, owner, director, officer, or contractor of a business.
Is the sunset date for these exemptions going to be delayed?
According to California’s legislative calendar, August 31, 2022 is the last day for the state’s legislative bodies to pass bills before the final recess of the year, whereas September 30th is the deadline for the governor to sign any bills into law that were passed by the legislative branch before September 1. Assembly Bill 1102, as amended, would extend the sunset dates for both the HR and B2B exemptions for two full years – until January 1, 2025. Consequently, if adopted and signed into law, Assembly Bill 1102 may serve as a last-minute extension of these exemptions, and covered businesses will have more time to phase out any reliance upon these exemptions in their compliance framework.
Need assistance with preparing for CPRA? The McGrath North Privacy and Cybersecurity team stands ready to assist with all of your business’s data regulation compliance needs.
Related Attorneys
