HR/Employee Data & B2B Data to Come Within Scope of CCPA on January 1, 2023

By Natalie Marcell, CIPP/US

The California legislature did not pass a bill to extend the California Consumer Privacy Act’s (CCPA) Human Resources (HR) and Business-to-Business (B2B) exemptions, and therefore both exemptions are set to expire on January 1, 2023. 

HR and B2B exemptions have been in effect since the CCPA first became enforceable on July 1, 2020.  The original expiration date for the exemptions was January 1, 2021, but the sunset date was moved out twice: first by the legislature and then by the passage of the California Privacy Rights Act (CPRA) which has set the sunset date for both exemptions on January 1, 2023.

September 1, 2022 was the deadline for the Legislature to pass a bill to extend the HR and B2B exemptions past the January 1, 2023 sunset date.  Several bills had been introduced that would have extended the exemptions, including : Assembly Bill (AB) 1102, AB 2871, AB 2891, and Senate Bill (SB) 1454. The Legislature adjourned its 2022 legislative session on August 31, 2022 without passing any legislation extending said exemptions.

This means that compliance policies will need to be updated as:

• Employee personal information will be subject to the CCPA requirements and consumer rights.  This includes personal information of job applications, employees, owners, shareholders, directors, officers, independent contractors, advisors, emergency contact information, personal information necessary to administer employee benefits. 
• Personal information collected in a B2B context will be subject to the CCPA requirements and consumer rights. This includes personal information collected by or processed by service providers and third parties.
• Employees will need to be given full CCPA disclosures.
• Requests from personnel, job applicants, and business contacts to exercise rights under the CCPA will need to be honored

The California Privacy Protection Agency (CPPA) has noted that a future rulemaking package could include HR employee data. The previously scheduled November 4, 2022 CPPA Board meeting was canceled on November 1, 2022.  The CPPA has not yet announced information about the next meeting date.