1. Home
  2. Insights
  3. CA Businesses Poised to Have CCPA Compliance Deadline Extended for B2B and Employee Data

CA Businesses Poised to Have CCPA Compliance Deadline Extended for B2B and Employee Data


August.31.2020

The California legislature has passed AB 1281 to the Governor’s desk for signature and, given the absence of legislative opposition, it appears the bill is now well positioned to be signed into law.  AB-1281 extends by one year the expiration date of the business-to-business (“B2B”) and employee-related exemptions provided for under the California Consumer Privacy Act (“CCPA”) (previously discussed here).  If signed into law, it will give California businesses at least one more year to work on folding employee and B2B data into their existing CCPA compliance programs, a welcome reprieve for California employers facing a resurgence of coronavirus cases in workplaces around the State.

Under the CCPA, the B2B and employee exemptions are currently set to expire on January 1, 2021. If AB 1281 is indeed signed into law, that expiration date will be extended to January 1, 2022.  It’s then possible that this expiration date will be extended by one additional year to January 1, 2023 if the proposed ballot measure known as the California Privacy Rights Act of 2020 (“CPRA”) makes it onto the November ballot in California’s general election and passes by a majority vote (we previously discussed the CPRA here and here).

As such, there are three potential scenarios in connection with the B2B and employee exemptions:

  1. CPRA is approved: exemptions will continue through January 1, 2023.

  2. AB-1281 passes, and CPRA is not approved: exemptions will continue through January 1, 2022.

  3. Both AB-1281 and the CPRA are not approved: exemptions will continue through January 1, 2021.

In California, both houses have until August 31, 2020 to pass bills. September 30, 2020 is the last day for the Governor to sign or veto bills.

Practice Note: Businesses should continue to monitor both AB 1281 and the CPRA. If both AB 1281 and the CPRA are not enacted, businesses may have only months to incorporate employee related and B2B  data into their full CCPA compliance program. Orrick will continue to monitor status and provide updates.