As the clock ticked to the close of California's 2019 legislative session on Friday the 13th, the California legislature passed several noteworthy amendments to the California Consumer Privacy Act (CCPA). Both the Senate and the Assembly passed five bills to amend the CCPAAB 25, 874, 1146, 1355, and 1564. If signed by the Governor, these pieces of legislation will alter the scope of the CCPA, most significantly by (albeit temporarily) removing employees from most provisions and materially narrowing its application to business-to-business (B2B) contacts. This alert reviews the changes that each of these bills propose.
Removing Employee and Business Contact Information from CCPA CoverageTemporarily
For businesses that collect little to no information from retail customers or other individuals that fit within the conventional concept of a consumer, AB 25 and AB 1355 could together have a significant impact. Taken together, these bills would remove personal information from employees and certain business contacts from most CCPA coverage. A one-year sunset clause makes these amendments inoperative on January 1, 2021, requiring the California legislature to come up with a more permanent solution or revert to the original CCPA text. Additionally, the exemptions do not apply to the CCPA's data breach cause of action, with potential statutory damages of $100 to $750 per consumer per incident.
AB 25 is the most prominent bill, and it proposes several amendments to the CCPA. Most notably, it excludes from most of the CCPA's key provisions any information that is collected about employees, job applicants, owners, directors, staff, officers, and contractors, as well as any emergency contact information those individuals provide to the business. Businesses would also still be required to provide employees with notices about what categories of information a business collects about them and their purpose for doing so, but they would not need to offer opt-out, access, and deletion rights.
AB 1355 adds an exemption for business contact information that a business collects during communications or transactions with another business or government agency (B2B transactions). Specifically, AB 1355 would exempt from most of the act's provisions personal information about an employee, owner, director, officer or contractor of a business or government agency collected by a business as part of B2B transactions, in the context of due diligence of, or the provision...